Both the General Data Protection Regulation (GDPR) and the Council of Europe Convention 108 establish a legal framework for the protection of personal data, which includes specific provisions for cross-border data flows. The GDPR dedicates Chapter V (Articles 44-50) to the "Transfers of personal data to third countries or international organisations," setting out conditions for such transfers. Similarly, Article 12 of the original Convention 108 (and Article 14 of the modernised Convention 108+) specifically addresses "transborder data flows," establishing principles to ensure that the protection of individuals is not undermined when their data is transferred abroad.

B. Both govern the manual processing of personal data Convention 108 applies primarily to the "automatic processing" of personal data. While member states may choose to extend its rules to manual files, this is not a mandatory requirement of the Convention itself.
C. Both only apply to European Union countries Convention 108 is a Council of Europe treaty, which is a separate entity from the EU with 46 member states. The Convention is also open to accession by non-member states, and several non-European countries have ratified it.
D. Both require notification of processing activities to a supervisory authority This was a requirement under the GDPR's predecessor, Directive 95/46/EC. Both the GDPR and the modernised Convention 108+ have replaced this general notification system with the principle of accountability, which includes obligations like maintaining records of processing activities (GDPR Article 30).

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Chapter V, Articles 44-50. This chapter explicitly lays out the legal framework and conditions for transferring personal data outside the European Economic Area.

2. Council of Europe, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 108), Strasbourg, 28.I.1981.

Article 12 – Transborder data flows: "A Party shall not, for the sole purpose of the protection of privacy, prohibit or subject to special authorisation transborder flows of personal data going to the territory of another Party." This article directly governs international transfers.

Article 3 – Scope: "The Parties undertake to apply this Convention to automated personal data files and automatic processing of personal data in the public and private sectors." This establishes the primary scope, with extensions to manual files being optional.

3. Explanatory Report to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Council of Europe, 1981, Paragraph 64. "This article [Article 12] deals with the classic problem of transborder data flows... It seeks to reconcile two conflicting interests: the interest of the free flow of information, regardless of frontiers, and the interest of protecting personal privacy."

4. European Union Agency for Fundamental Rights and Council of Europe, Handbook on European data protection law, 2018 Edition.

Page 40: "Convention 108 is a treaty of the Council of Europe... The Council of Europe has 47 member states [note: now 46], including all EU Member States... Convention 108 is also open for accession by countries that are not members of the Council of Europe." This confirms that its geographic scope is not limited to the EU.

Page 139: "The GDPR has abolished the general obligation to notify processing operations to the supervisory authority, which existed under the DPD [Data Protection Directive 95/46/EC]." This confirms the inaccuracy of option D for the GDPR.