UN Convention on Cybercrime: Real Obligations for Tech Companies and ICT Operators in the EU

Key data

If your company operates in the technology sector, manages communications infrastructure or stores user data, the UN Convention on Cybercrime is already binding law in the EU as of 19 June 2026. Council Decision (EU) 2026/1347 of 4 June 2026 formalized the ratification on behalf of the entire European Union, and the corrigendum published on 20 October 2026 in the Official Journal confirms without substantive changes that framework of obligations.

The question that executives should ask themselves is not whether this affects them, but when they will receive the first request and whether they have the internal procedures to respond correctly.

What does this regulation establish?

The United Nations Convention on Cybercrime establishes two major operational pillars that directly affect the private sector:

• International cooperation framework: It obliges EU Member States to establish mechanisms for digital mutual legal assistance. In practice, this means that a criminal investigation initiated in another country can generate information requests directed at companies established in Spain or any other Member State.
• Cross-border transmission of electronic evidence: It regulates how digital evidence is obtained and transferred in cases of serious crimes committed through ICT systems. Companies that hold that data (logs, communications, transaction records) are key actors in this process.

The correction published on 20 October 2026 is exclusively technical-formal in nature: it corrects drafting or reference errors in Decision 2026/1347 without modifying any of the substantive commitments assumed by the EU when ratifying the Convention. The entry into force date remains unchanged: 19 June 2026.

Economic and operational impact

The Convention does not establish direct economic sanctions for companies, but its operational and compliance impact is real and measurable on several fronts:

• Compliance costs: Tech companies and ICT operators will need to review and, in many cases, strengthen their internal protocols for responding to international judicial requests. This involves legal, technical and compliance resources.
• Data management under request: Entities managing user data may receive requests to deliver information in the context of international criminal investigations. Not having a clear procedure can result in non-compliance with legal consequences.
• Digital mutual legal assistance: Member States are obliged to strengthen their cooperation mechanisms, which in practice can translate into new regulatory requirements at the national level that affect private operators.
• Reputational risk: Inadequate handling of international requests can expose the company to public and regulatory scrutiny, especially in sectors with high data visibility (telecommunications, digital platforms, cloud services).

Who does it affect?

• Tech companies operating digital platforms, cloud services or data infrastructure in the EU.
• Telecommunications operators subject to requests for transmission of traffic or communications data.
• Data management entities that hold records that may be used as electronic evidence in criminal investigations.
• Judicial and police authorities in the EU, which will need to adapt their digital mutual legal assistance procedures.
• Legal and compliance departments of any company with significant digital presence in the EU.
• Internet service providers (ISPs) and electronic communications platforms.

Practical example

Imagine a Spanish software-as-a-service (SaaS) company with clients in several EU countries. In the context of a criminal investigation into computer fraud initiated in Germany, German authorities request through the digital mutual legal assistance mechanism—reinforced by this Convention—the access and activity records of a specific user stored on the Spanish company's servers.

Under the framework of the UN Convention ratified by Decision 2026/1347, Spain is obliged to process that request. The company will receive a formal request from the competent Spanish authorities to deliver that electronic evidence. If the company does not have a defined protocol for this type of request—who responds, within what timeframe, what data is delivered and under what legal guarantees—it may incur delays or errors that generate legal liability.

The corrigendum published on 20 October 2026 does not alter this scenario: the substantive commitments have been in force since 19 June 2026.

What should companies do now?

1. Audit internal protocols for responding to international judicial requests. Verify whether your company has a documented procedure for handling requests from foreign authorities channeled through mutual legal assistance mechanisms. If it does not exist, now is the time to create it.
2. Identify what data your company holds that may be relevant as electronic evidence. Access logs, communications records, transaction data and any information that could be requested in the context of an international criminal investigation.
3. Review data retention and access policies. Ensure that data retention periods are compatible with the requests you could receive, without conflicting with the GDPR.
4. Designate an internal point of contact for judicial requests. This should be someone with decision-making authority and access to the legal department, capable of coordinating the response in a timely manner.
5. Consult with legal advisors specialized in cyberlaw and international judicial cooperation. The intersection between the UN Convention, the GDPR and national telecommunications regulations requires specific analysis for each type of company.

Official source

Consult the complete regulation in the official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202690903