EU Entry/Exit System (EES) and ETIAS: data, dates and oversight

Last checked: 21 October 2026 · Rules and oversight

The Entry/Exit System (EES) is the EU database that records non-EU short-stay travellers' names, travel documents, fingerprints, facial images and dates of entry and exit ¹. It started on 12 October 2025 and became fully operational on 10 April 2026 ¹. ETIAS is a planned travel authorisation for visa-exempt travellers, set up by Regulation (EU) 2018/1240. It was not in operation as of July 2026 ⁵. eu-LISA develops both systems and the EDPS audits eu-LISA's work ^2,4 ⁷.

EES law: Regulation (EU) 2017/2226 of 30 November 2017 ²
EES start: Progressive start 12 October 2025, fully operational 10 April 2026 ¹
EES retention: 3 years, or 5 years for people who overstay ²
ETIAS law: Regulation (EU) 2018/1240, in force 9 October 2018 ³
ETIAS start: Not in operation, start date to be announced several months ahead ^3,5
ETIAS fee: EUR 20, raised from EUR 7 ³
Developer: eu-LISA ^2,4
Oversight: EDPS for eu-LISA, national authorities for Member States, jointly through the Coordinated Supervision Committee ⁷

What the EES records

The EES records third-country nationals admitted for short stays at the external borders of the Schengen area. The Commission lists the data as name, travel document data, fingerprints, facial images, date and place of entry and exit, and refusals of entry ¹.

Individual file: surname, given names, date of birth, nationality, sex, travel document type and number, issuing country, expiry date and a facial image (Article 16) ²
Visa holders: visa sticker number, visa type, end of authorised stay and visa expiry, where they apply (Article 16) ²
Visa-exempt travellers: the same identity data and facial image, plus fingerprints (Article 17). The recitals refer to four fingerprints ²
Entry and exit records: date and time, and border crossing point (Article 16) ²
Children under 12 are exempt from fingerprinting (Article 17) ²

EES start dates and retention

On 30 July 2025 the Commission set 12 October 2025 as the launch date for the progressive start of operations. The Commission says the system became fully operational on 10 April 2026 ¹.

The Regulation's recitals say data on travellers who respect the authorised stay is kept for three years. Data on people who stay beyond the authorised period is kept for five years ². Records for certain family members of EU citizens are kept for a maximum of one year after exit ².

ETIAS: what it is and when it starts

ETIAS will require visa-exempt travellers to hold an authorisation before short stays. Regulation (EU) 2018/1240 was adopted on 12 September 2018 and entered into force on 9 October 2018 ³. The fee will be EUR 20, up from EUR 7 in the original text ³.

The Commission page dated 6 October 2025 says ETIAS is not in operation and the EU will announce the start date several months before launch ³. The Dutch government page, last modified on 27 July 2026, says the same and states that no applications are being collected ⁵. The Norwegian Police page gives the same position ⁶.

Application data, per the Regulation's recitals: identity, travel document, residence, contact details, education level and job group, and answers to background questions ⁴
Retention: the validity period of the authorisation, or five years from the last decision to refuse, annul or revoke it (Article 24) ⁴
With the applicant's explicit consent, the file may be kept up to three more years after validity ends ⁴

eu-LISA and EDPS oversight

Article 5 of the EES Regulation says eu-LISA shall develop the EES and run its operational management ². Article 6 of the ETIAS Regulation gives eu-LISA the same development and technical management role for the ETIAS Information System ⁴.

In a press release of 24 October 2025, the European Data Protection Supervisor said it is responsible for auditing the measures eu-LISA takes on EES security and the network linking Member States to the central system ⁷. Oversight of the EES as a whole falls to the Coordinated Supervision Committee, made up of national supervisory authorities and the EDPS ⁷. The EDPS said it had given advice on the Commission's guidance for the progressive start ⁷.

Common questions

When did the EU Entry/Exit System start?

The progressive start began on 12 October 2025. The Commission says the EES became fully operational on 10 April 2026 ¹.

Has ETIAS started?

No. Official pages say ETIAS is not in operation and the start date will be announced several months ahead ^3,5.

How long does the EES keep my fingerprints and photo?

Three years for travellers who respect their authorised stay and five years for those who overstay, per the Regulation's recitals ².

Who supervises EES data protection?

The EDPS audits eu-LISA. National authorities and the EDPS work together in the Coordinated Supervision Committee ⁷.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.

Sources

Biometric data at borders
Which fingerprints and facial images border agencies collect from travellers, the legal basis, who holds the records and how long they are kept.
The EU PNR Directive (Directive (EU) 2016/681)
What the EU PNR Directive requires of airlines and Member States, the 19 data elements it covers, retention rules, and what the EU Court of Justice ruled.
Passenger data retention
How long governments keep PNR, API and biometric records about air travellers, what must be masked or deleted, and what the EU Court of Justice ruled.
E-visa and electronic travel authorisation data
What US ESTA, UK ETA, Canada eTA, Kenya ETA, EU ETIAS and India e-Visa collect from travellers, and how long the data is kept.
Who oversees passenger data
The bodies that check how governments use API and PNR data: data protection authorities, data protection officers, courts and UN standards.