Strasbourg, 10 October 2025 T-PD(2025)2rev2

CONSULTATIVE COMMITTEE OF THE CONVENTION
FOR THE PROTECTION OF INDIVIDUALS WITH REGARD TO
AUTOMATIC PROCESSING OF PERSONAL DATA

(CONVENTION 108)

Revised information note on possible further actions regarding the transborder flows of personal data

www.coe.int/dataprotection

I. INTRODUCTION

1. This information note prepared by the Secretariat and discussed at the 48^th plenary meeting of the Committee of Convention 108 (T-PD) was subsequently revised based on written comments and suggestions provided by the representatives of Parties and Observers. The present revised note serves to outline some of the possible actions regarding transborder flows of personal data to be discussed and decided upon at the 49^th plenary meeting of the Committee with a view of their integration in the next Work Programme of the Committee for 2026-29. The proposed actions are made to further support the Committee’s efforts in securing the free flow of information between the Parties based on Convention 108+ as well as facilitating such information flows from the Parties to non-Parties in a changing global context. These actions are aligned with the objectives of Convention 108+ to “promote at the global level the fundamental values of respect for privacy and protection of personal data, thereby contributing to the free flow of information between people[1]” and prior commitments of the Committee to facilitate convergence towards a high set of standards globally.

2. Given the important role of global data flows for the rapidly developing digital economies and societies, international data transfers underpin modern economies, support innovation and inclusive information societies as well as other objectives held in legitimate interest. Meanwhile, the risk that the inappropriately protected transborder flows of personal data may have adverse impacts and effects on privacy, data protection and other human rights and fundamental freedoms once again underscores the importance of securing the level of protection Convention 108+ provides in case of transborder flows of personal data. For such purpose it seems to be a need to a) develop further guidance and practical tools on a harmonised implementation of the provisions of Convention 108+ on transborder flows of personal data (Article 14) between Parties, and b) to further interpret the principle of the appropriate level of data protection which is required for securing the transborder flows of personal data, notably when the recipient is subject to the jurisdiction of a country that is a Non-Party to the Convention 108+.

3. To foster free and secure transborder flows of personal data from Parties to non-Parties, the promotion and use of the adopted CoE Model Contractual Clauses (MCC) is to be prioritised. Those tools, if used widely will contribute to securing an appropriate level of protection of data, hence advancing the very objectives of Convention 108+. Additional efforts could also to be considered to further support global convergence, free and secure data flows as detailed below.

4. The revised information note is designed to propose for discussion and decision on the below actions on transborder flows of personal data, that the Committee of Convention 108 could undertake as part of its Working Programme 2026-29. With the aim of promoting the standards of Convention 108+ and the tools the Committee developed based thereof, such as the adopted CoE Model Contractual Clauses (MCC), the Consultative Committee is proposed to consider the following actions (see II. Proposed Actions).

II. PROPOSED ACTIONS

ACTION

SUB-ACTIVITY

ADDITIONAL DESCRIPTION

A. Assisting and supporting the recognition and approval of the CoE MCC by the competent authorities in the Parties (DPAs and other competent authorities) and by strategic partner organisations, institutions. Promote and support the use of CoE MCC as approved standardised contractual clause under the interested domestic legal frameworks.

A.1 Keeping awareness of the DPAs and other competent authorities in the Parties of Convention 108/Convention 108+, through their engagement in multilateral dialogues, showcasing national experience and domestic processes, and proposing capacity-building initiatives.

The initiative proposes to promote the approval of the developed CoE MCC by the Parties to ensure an appropriate level of protection guaranteed by Convention 108+. The process may be supported by raising/keeping the awareness on the need of the formal recognition or approval of the CoE MCC as a readily available instrument/legal basis, in all Parties, for transborder flows of personal data.

Additionally, an Action Plan is to be drawn with the cooperation of competent national authorities to approve the CoE MCC by the majority of Parties by 2029, including by making available further supplementary materials (e.g., specific guidance, explanatory report, guidelines and relevant strategic plan, etc.).

A.2 Developing an Action Plan on the approval of the CoE MCC’s in Parties of Convention 108+, including a specific guidance for transforming CoE MCC into an easily transposable, operational instrument to ensure its accessibility and wider use.

B. As part of the upcoming Work Programme 2026-2029 the Committee is invited to develop a practical guide relating to transfer regimes and tools based on Art. 14 of the Convention 108+ on the transborder flows of personal data.

B.1 An inventory of the data transfer regimes and tools is to be developed by the Committee based on the Art. 14 of the Convention 108+ and is to be published on the webpage by the Secretariat.

Art. 14 of the Convention 108+ provides for the legal basis for transborder data flows of personal data as well as the relevant transfer tools and conditions under which the personal data may be transferred.

The initiative aims at creating an inventory of the data transfer regimes and tools by the Committee and making them available in an interactive and easily understandable format by the Secretariat on the data protection website of the CoE (www.coe.int/dataprotection).

It further encompasses the development of guidelines on the legal basis for transborder flows of personal data between the Parties (data flow regimes), as set out in Art. 14(1) and on the transfer to non-Parties (Art. 14(2) – (3)). It can furthermore include developing model templates for ad hoc safeguards (having approved standard contractual clauses already available), drafting interpretative materials regarding additional guarantees provided by Art. 14(5) and (6) as a baseline for appropriate protection.

B.2 Development of guidelines on provisions on the legal basis for transborder flows of personal data to support operational functionality of data transfer regimes and other available transfer tools based on Article 14.

C. Promoting CoE standards and tools (such as CoE MCC) in global data protection platforms or forums.

C.1 Study the possibility of an active engagement in existing or upcoming global, regional initiatives and expert discussions by appointed rapporteurs to exchange on data transfer frameworks (such as: OECD, GPA, RIPD, NADPA, Global CBPR Forum, ASEAN, G7, etc.). Increase the visibility of the work of the Committee and the Secretariat in relation to initiatives that align with the principle of transborder data flows with trust, with a focus on CoE MCCs.

In addition to the work on the promotion of the CoE MCCs, appointment of rapporteurs may be envisaged to inform the Committee on the ongoing work in other forums on transborder flows of data and to ensure active contributions to these discussions based on Convention 108+.

Building on the functions of the Consultative Committee (Art. 23(g) of the Convention 108+), and to support the previous action, the development of reports, studies and guidance on global convergence could be envisaged, if required by the Committee. Such actions could aim to propose the development of models of safeguards regarding trusted, lawful and convergent transborder flows of personal data, and to promote data flows in way that is consistent with Convention 108+.

C.2 Developing report, studies and guidance, if required on global convergence to contribute to ongoing discussions on transborder flows of data in other forums.

[1] See Preamble of Convention 108+.