(1)

In accordance with Council Decision (EU) 2025/2307 (2) the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes (the ‘Convention’) was signed, on behalf of the Union, in Hanoi, Viet Nam, on 25 October 2025, subject to the conclusion of the said Convention.

(2)

The Convention is in conformity with the security objectives of the Union as referred to in Article 67(3) of the Treaty on the Functioning of the European Union (TFEU), namely ensuring a high level of security through measures to prevent and combat crime and through measures for coordination and cooperation between police and judicial authorities and other competent authorities, as well as through the approximation of criminal laws.

(3)

The Convention applies to specific criminal investigations or proceedings concerning criminal offences established in accordance with the Convention as well as to the exchange of evidence in electronic form concerning serious crimes (offences punishable by a maximum deprivation of liberty of at least four years or a more serious penalty) and only allows for the exchange of information for such purposes.

(4)

The Convention harmonises a limited set of clearly defined offences while allowing the necessary flexibility for States Parties to avoid criminalisation of legitimate conduct.

(5)

The Convention establishes only minimum rules on the liability of legal persons for participation in the offences established in accordance with the Convention. It does not require States Parties to adopt such measures as may be necessary to establish liability of legal persons in a manner that would be inconsistent with their legal principles.

(6)

The Convention is also in conformity with the personal data, privacy and fundamental rights protection objectives of the Union, in line with Article 16 TFEU and the Charter of Fundamental Rights of the European Union (the ‘Charter’).

(7)

The Convention provides for robust human rights conditions and safeguards, which are part of the object and purpose of the Convention and are inextricably linked to the powers and procedures provided for by the Convention. As such, those conditions and safeguards cannot be subject to reservations. The Convention excludes any interpretation that would lead to suppressing human rights or fundamental freedoms, in particular the freedoms of expression, conscience, opinion, religion or belief, peaceful assembly and association. These safeguards also ensure that international cooperation can be refused if that international cooperation would be contrary to States Parties’ domestic laws or if such refusal would be necessary to avoid any form of discrimination.

(8)

Concerning the powers and procedures both at domestic and international levels, the Convention provides for horizontal conditions and safeguards ensuring the protection of human rights, in accordance with States Parties’ obligations under international human rights law. States Parties are to also incorporate the principle of proportionality into their domestic law. Such conditions and safeguards are to include, inter alia, judicial or other independent review, the right to an effective remedy, grounds justifying application and limitation of the scope and the duration of such powers and procedures.

(9)

The Convention includes a dedicated provision on the protection of personal data, which ensures that important data protection principles, including purpose limitation, data minimisation, proportionality and necessity are applied, in accordance with the Charter, before any personal data can be provided to another State Party.

(10)

With its participation in the negotiations, on behalf of the Union, the Commission ensured compatibility of the Convention with relevant Union rules.

(11)

A number of reservations are relevant to ensure compatibility of the Convention with Union law and policies, as well as the uniform application of the Convention amongst Member States in their relations with non-EU State Parties, and the effective application of the Convention.

(12)

The reservations are without prejudice to any other reservations that Member States might wish to make individually where permissible.

(13)

Given that the Convention provides for procedures that improve cross-border access to evidence in electronic form and a high level of safeguards, becoming a party to the Convention will promote consistency in the Union’s efforts in combatting cybercrime and other forms of crime at global level. It will facilitate cooperation between the EU States Parties and the non-EU States Parties while ensuring a high level of protection of individuals.

(14)

Swift conclusion of the Convention by the Union will furthermore ensure that the Union has a meaningful voice early in the implementation of this new global framework for the fight against cybercrime.

(15)

Pursuant to its Article 64(3), the Convention is subject to ratification, acceptance or approval by States and regional economic integration organisations, such as the Union.

(16)

The Union should become a party to the Convention alongside its Member States, since the Union and its Member States have competences in the areas covered by the Convention. The conclusion of the Convention by the Union is without prejudice to the competence of the Member States as regards the ratification, acceptance or approval of the Convention, in accordance with their internal procedures. The Convention should be concluded on behalf of the Union as regards matters falling within the competence of the Union insofar as the Convention may affect common rules or alter their scope. In the area of shared competences, the Member States retain their competence insofar as the Convention does not affect common rules or alter their scope.

(17)

In accordance with the Convention, the Union is, in its instrument of ratification, acceptance, approval or accession, to declare the extent of its competence with respect to the matters governed by the Convention. The Union defined the extent of its competence with respect to the matters governed by the Convention in the Declaration of competence of the European Union made in accordance with Article 64(3) and (4) of the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes (the ‘Declaration of competence’).

(18)

The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (3) and delivered an opinion on 4 September 2025.

(19)

In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union (TEU) and to the TFEU, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Decision and is not bound by it or subject to its application.

(20)

In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the TEU and to the TFEU, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application.

(21)

The Convention, the attached reservations and the Declaration of competence should be approved,