Airlines and passenger data

Where the data sits inside an airline

IATA describes PNR as reservation data held in airline reservation systems, covering itinerary, contact details, ticketing, baggage and other booking elements ¹. API is biographic, travel document and flight data collected by aircraft operators and sent to border authorities before departure or arrival ¹. IATA says government rules should be achievable within existing airline reservation, departure control and messaging systems ¹.

Amadeus describes its Altea Departure Control product, a departure control system (DCS), as handling check-in through online, kiosk and phone channels, boarding and baggage rules, with automatic regulatory checks to limit penalties (provider page) ⁸. The provider page does not say how it transmits API data to governments ⁸.

IATA says API should be sent as UN/EDIFACT PAXLST messages and PNR in the PNRGOV standard ¹. It recommends a single window, one entry point through which carriers meet all national reporting duties ¹.

What carriers must collect

Carrier duties beyond sending data

• US carriers must compare the passenger's travel document with the data sent to CBP to confirm it is accurate and belongs to the passenger ².
• US airlines may not issue a boarding pass until TSA reports the watch-list result for that passenger ¹⁰.
• Under Regulation (EU) 2025/12, carriers must read the machine-readable zone of the travel document by automated means and may enter data by hand only where that is not technically possible ³.
• UK carriers must seek authority to carry each passenger and must tell a refused passenger using Home Office wording ⁵.
• Kenyan carriers must register with the Director of Immigration Services before they submit data ⁶.

Fines for carriers

Directive 2004/82/EC of 29 April 2004 required Member States to set penalties for carriers that fail to send data or send false data. The maximum fine had to be at least EUR 5,000 per journey, or the minimum at least EUR 3,000 ⁴. Regulation (EU) 2025/12 repeals that Directive ³. Article 37 says recurrent failure to transfer API data is subject to fines of up to 2% of the carrier's global turnover in the preceding financial year ³.

The UK Authority to Carry Scheme 2023 says a carrier may face a civil penalty of up to £50,000 for each breach, with a defence of reasonable excuse ⁵. Kenya sets an administrative penalty of US$10,000 for inaccurate or misleading data, with no penalty if the carrier shows it did not act knowingly or recklessly ⁶.

On 30 July 2026, IATA, AFRAA and AASA asked African governments not to fund API and PNR programmes through charges on airlines or passengers, citing ICAO Doc 9082 ⁹.

How long airlines keep the data

Under Regulation (EU) 2025/12, carriers store API data for 48 hours from receipt by the router and then delete it, without prejudice to normal business use ³. The earlier Directive required deletion within 24 hours of arrival ⁴.

British Airways says it keeps PNR for 7 years from the date of travel and then deletes or anonymises it (company statement) ⁷. It says it does not control how long governments keep data once sent ⁷.

What airline privacy notices say

The British Airways privacy policy, last updated August 2026, names British Airways Plc as data controller ⁷. It says some countries require airlines to send name, date of birth and passport details before travel, and that it relies on legal obligation where UK or EU law requires this ⁷. Where another country's rule is not a legal obligation under UK law, it relies on performance of its contract with the passenger ⁷. It says PNR may be shared with border, customs, immigration, security and law enforcement authorities in countries the passenger flies to, from, over or through (company statement) ⁷.