Council Decision (EU) 2025/2307 of 13 October 2025 on the signing, on behalf of the European Union, of the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes

Official Journal EN of the European Union L series 2025/2307 11.11.2025 COUNCIL DECISION (EU) 2025/2307 of 13 October 2025 on the signing, on behalf of the European Union, of the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16, Article 82(1), Article 83(1) and Article 87(2) in conjunction with Article 218(5) thereof, Having regard to the proposal from the European Commission,

Whereas:

(1) On 24 May 2022, Council Decision (EU) 2022/895(1)authorised the Commission to open negotiations, on behalf of the European Union, for a United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes (the ‘Convention’).

(2) The text of the Convention was adopted on 24 December 2024 by Resolution 79/243 at the 55th plenary meeting of the General Assembly of the United Nations General and is envisaged to be open for signature in Hanoi, Vietnam, from 25 to 26 October 2025 and thereafter at United Nations Headquarters in New York until 31 December 2026.

(3) The Convention is in conformity with the security objectives of the Union as referred to in Article 67(3) of the Treaty on the Functioning of the European Union (TFEU), namely ensuring a high level of security through measures to prevent and combat crime and through measures for coordination and cooperation between police and judicial authorities and other competent authorities, as well as through the approximation of criminal laws.

(4) The Convention applies to specific criminal investigations or proceedings concerning criminal offences established in accordance with the Convention as well as to the exchange of evidence in electronic form concerning serious crimes (offences punishable by a maximum deprivation of liberty of at least four years or a more serious penalty) and only allows for the exchange of information for such purposes.

(5) The Convention harmonises a limited set of clearly defined offences while allowing the necessary flexibility for States Parties to avoid criminalisation of legitimate conduct.

(6) The Convention establishes only minimum rules on the liability of legal persons for participation in the offences established in accordance with the Convention. It does not require State Parties to adopt such measures as may be necessary to establish liability of legal persons in a manner that would be inconsistent with their legal principles.

(7) The Convention is also in conformity with the personal data, privacy and fundamental rights protection objectives of the Union, in line with Article 16 TFEU and the Charter of Fundamental Rights of the European Union (the ‘Charter’).

(8) The Convention provides for robust human rights safeguards and excludes any interpretation that would lead to suppressing human rights or fundamental freedoms, in particular the freedoms of expression, conscience, opinion, religion or belief, peaceful assembly and association. These safeguards also ensure that international cooperation can be refused if that international cooperation would be contrary to States Parties’ domestic laws or if such refusal would be necessary to avoid any form of discrimination.

(1) Council Decision (EU) 2022/895 of 24 May 2022 authorising the opening of negotiations on behalf of the European Union for a comprehensive international convention on countering the use of information and communications technologies for criminal purposes (OJ L 155, 8.6.2022, p. 42, ELI: http://data.europa.eu/eli/dec/2022/895/oj).

ELI: http://data.europa.eu/eli/dec/2025/2307/oj 1/3EN OJ L, 11.11.2025

(9) Concerning the powers and procedures both at domestic and international levels, the Convention provides for horizontal conditions and safeguards ensuring the protection of human rights, in accordance with States Parties’ obligations under international human rights law. States Parties are to also incorporate the principle of proportionality into their domestic law. Such conditions and safeguards are to include, inter alia, judicial or other independent review, the right to an effective remedy, grounds justifying application and limitation of the scope and the duration of such powers and procedures.

(10) The Convention includes a dedicated provision on the protection of personal data, which ensures that important data protection principles, including purpose limitation, data minimisation, proportionality and necessity must be applied, in accordance with the Charter, before any personal data can be provided to another State Party.

(11) With its participation in the negotiations, on behalf of the Union, the Commission ensured compatibility of the Convention with relevant Union rules.

(12) A number of reservations and notifications are relevant to ensure compatibility of the Convention with Union law and policies, as well as the uniform application of the Convention amongst Member States in their relations with non-EU State Parties, and the effective application of the Convention.

(13) Given that the Convention provides for procedures that improve cross-border access to evidence in electronic form and a high level of safeguards, becoming a party to the Convention will promote consistency in the Union’s efforts in combating cybercrime and other forms of crime at global level. It will facilitate cooperation between the EU States Parties and the non-EU States Parties while ensuring a high level of protection of individuals.

(14) In accordance with its Article 64(2), the Convention is open for signature by the Union.

(15) The Union should become a party to the Convention alongside its Member States, since the Union and its Member States have competences in the areas covered by the Convention. This Decision is without prejudice to the signature of the Convention by the Member States, in accordance with their internal procedures. The Convention should be signed on behalf of the Union as regards matters falling within the competence of the Union insofar as the Convention may affect common rules or alter their scope. In the area of shared competences, the Member States retain their competence insofar as the Convention does not affect common rules or alter their scope.

(16) The swift signature of the Convention by the Union will furthermore ensure that the Union has a meaningful voice early in the implementation of this new global framework for the fight against cybercrime.

(17) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council(2) and delivered an opinion on 4 September 2025.

(18) In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union (TEU) and to the TFEU, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Decision and is not bound by it or subject to its application.

(19) In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the TEU and to the TFEU, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application.

(20) The Convention should be signed,

HAS ADOPTED THIS DECISION:

Article 1 The signing of the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes (the ‘Convention’) is hereby authorised on behalf of the European Union, subject to the conclusion of the said Convention.

(2) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39,

ELI: http://data.europa.eu/eli/reg/2018/1725/oj).

2/3 ELI: http://data.europa.eu/eli/dec/2025/2307/ojEN OJ L, 11.11.2025 Article 2 This Decision shall enter into force on the date of its adoption.

Done at Luxembourg, 13 October 2025.

For the Council The President P. HUMMELGAARD

ELI: http://data.europa.eu/eli/dec/2025/2307/oj 3/3