Access logging and audit trails

Q: How long are PNR access logs kept in the EU?

Five years under Article 13(6) of the PNR Directive.

Q: Are airline queries to the EES logged?

Yes. Carrier web service logs are stored for two years.

Last checked: 21 October 2026 · How passenger data works

Access logging is the automatic recording of who collected, viewed, changed, shared or deleted passenger data, and when ^1,2. An audit trail built from those logs lets data protection officers and supervisory authorities check whether each use was lawful ². The EU PNR Directive requires Passenger Information Units to log collection, consultation, disclosure and erasure and keep those records for five years ¹. EU law enforcement controllers must hand logs to the supervisory authority on request ².

EU PNR log retention: Five years ¹
EU PNR operations logged: Collection, consultation, disclosure, erasure ¹
EU law enforcement rule: Article 25, Directive (EU) 2016/680 ²
EES carrier access logs: Kept two years ³

What a log records

Article 25 of Directive (EU) 2016/680, which covers police and other competent authorities, requires logs for at least collection, alteration, consultation, disclosure including transfers, combination and erasure ².

Logs of consultation and disclosure must show the justification, date and time ². Where possible they must show who consulted or disclosed the data and who received it ².

Rules for PNR data

Article 13(6) of the EU PNR Directive requires each Passenger Information Unit to keep records of at least collection, consultation, disclosure and erasure ¹. The records may be used only for verification, self-monitoring, data integrity and security, or auditing ¹. They are kept for five years ¹.

Unmasking a PNR record after six months needs approval from a judicial or other competent authority ¹. The PIU data protection officer must be informed and carries out an ex-post review ¹.

Carrier access to border systems

Airlines can query the EU Entry/Exit System through a web service. Article 13(4) of Regulation (EU) 2017/2226 says logs of that carrier access are stored for two years ³. The logs must be protected against unauthorised access ³.

Who may use the logs

Under Article 25(3) of Directive (EU) 2016/680, the controller and processor must make logs available to the supervisory authority on request ².

Rule	Permitted uses of logs	Log retention
EU PNR Directive, Article 13(6) ¹	Verification, self-monitoring, data integrity and security, auditing ¹	Five years ¹
Directive (EU) 2016/680, Article 25 ²	Checking lawfulness, self-monitoring, integrity and security, criminal proceedings ²	Not fixed in Article 25 ²
EES Regulation, Article 13(4) ³	Record of carrier queries, protected against unauthorised access ³	Two years ³

When controls failed: the 2019 CBP pilot

On 21 September 2020 the DHS Office of Inspector General (OIG) published report OIG-20-71 on a breach in a US Customs and Border Protection facial recognition pilot at the Anzalduas, Texas port of entry ⁴. The OIG found that CBP did not adequately safeguard sensitive data on an unencrypted device used during the pilot ⁴.

The report says CBP did not know of or authorise the subcontractor's removal of data ⁴. An open USB port let staff of subcontractor Perceptics, LLC copy data to an unencrypted hard drive ⁴. CBP found out about the breach from a news article about one week after Perceptics notified the prime contractor, Unisys ⁴.

After the breach CBP disabled all USB capabilities on the pilot devices ⁴. The OIG made three recommendations, including USB restrictions, stronger encryption and routine checks of third-party equipment ⁴. CBP concurred with all three. The OIG kept them open pending documentation ⁴.

Common questions

What must a passenger data access log show?

Under Directive (EU) 2016/680, logs of consultation and disclosure show the justification, date and time and, where possible, who acted and who received the data ².

How long are PNR access logs kept in the EU?

Five years under Article 13(6) of the PNR Directive ¹.

Can a regulator see the logs?

Yes. EU law requires controllers and processors to make logs available to the supervisory authority on request ².

Are airline queries to the EES logged?

Yes. Carrier web service logs are stored for two years ³.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.

Sources

Passenger data retention
How long governments keep PNR, API and biometric records about air travellers, what must be masked or deleted, and what the EU Court of Justice ruled.
Passenger data breaches
What counts as a passenger data breach, who must be told and how fast, and what a US audit found after border biometric images were stolen.
Who oversees passenger data
The bodies that check how governments use API and PNR data: data protection authorities, data protection officers, courts and UN standards.
Passenger Information Units
What a Passenger Information Unit does with API and PNR data, the EU rules that govern it, the limits set by the EU Court of Justice, and examples.
How to request your passenger data
Official routes to ask for your API, PNR and border records in the EU, UK, US, Canada and Kenya, and what an authority may withhold.