Passenger Name Record (PNR) data explained

Q: How long is my PNR kept?

Five years under the EU directive. The Court of Justice limited retention after six months to passengers with objective evidence of risk. Canada keeps it three and a half years.

Q: Can PNR rules cover flights inside the EU?

Yes, if a state notifies the Commission. The Court of Justice said it needs a genuine and present or foreseeable terrorist threat to cover all such flights.

Last checked: 21 October 2026 · How passenger data works

A Passenger Name Record (PNR) is the reservation data held in airline reservation systems ¹. It can include contact details, payment information, the full itinerary, seat and baggage details, travel agent and frequent flyer data ². Airlines send it to a government Passenger Information Unit (PIU), which can assess passengers before arrival or departure ². EU law lets PIUs keep PNR for five years, masked after six months ². On 21 June 2022 the EU Court of Justice ruled that one five-year period for all passengers is not allowed ⁴.

What it is: Reservation data held in airline reservation systems ¹
Who sends it: Air carriers ²
Who receives it: A Passenger Information Unit in each EU state ²
Message standard: PNRGOV ¹
UN mandate: Resolution 2396 (2017), paragraph 12 ⁵
ICAO rules: Annex 9 Amendment 28, 11 standards and 6 recommended practices on PNR ⁶
EU law: Directive (EU) 2016/681 of 27 April 2016 ³
EU retention: Five years, identifying elements masked after six months ²

Which data fields PNR contains

Annex I of the EU PNR directive lists 19 data elements ².

Record locator, booking date, travel dates and names ²
Address, contact and payment information ²
Full itinerary, travel agency or agent, and frequent flyer data ²
Travel status, split PNR data, general remarks and ticketing data ²
Seat, code share and baggage information ²
Number and names of other travellers on the record ²
Any API data collected, and the history of changes to the other items ²

Who sends it, who receives it, and when

Under the EU directive, air carriers send PNR to the PIU of the state of arrival or departure. Each state must set up or name a PIU ². Carriers push the data twice, 24 to 48 hours before scheduled departure and again right after flight closure ². IATA guidance says PNR should use the PNRGOV message standard ¹.

In the United States, carriers flying to or from the country must give Customs access on request to PNR elements on the identity and travel plans of a passenger. The rule does not require carriers to collect data they do not already hold ⁷. Canada requires available PNR for all travellers before a flight arrives ⁸.

Legal basis

Resolution 2396 (2017), paragraph 12, decides that member states shall develop the capability to collect, process and analyse PNR data in furtherance of ICAO standards and recommended practices ⁵. ICAO Annex 9 Amendment 28 added 11 standards and 6 recommended practices on PNR. ICAO Doc 9944 holds its PNR guidelines ⁶.

The EU PNR directive was adopted on 27 April 2016 and entered into force on 24 May 2016 ³. States had to apply it by 25 May 2018. A state may extend it to flights within the EU by written notice to the Commission ².

Retention and limits

The directive sets five years of retention at the PIU. After six months, names, contact details, payment data, frequent flyer data and any API data are masked. Unmasked data may be released only with approval of a judicial authority or another competent national authority ². Data revealing race, ethnic origin, political opinions, religion, trade union membership, health or sex life must be deleted immediately ².

In Case C-817/19, Ligue des droits humains, the Court of Justice ruled on 21 June 2022 that keeping all passengers' data for six months is acceptable in principle. Keeping data after six months on passengers with no objective evidence of risk goes beyond what is necessary ⁴. The Court said a PIU may not use self-learning systems that change the assessment criteria without human review. It required human checks of positive matches, citing the number of false positives in 2018 and 2019 ⁴.

Country examples

Jurisdiction	Rule or programme	What the record says
European Union ²	Directive (EU) 2016/681 ²	Five-year retention, limited by the 2022 Court ruling ⁴
United States ⁷	19 CFR 122.49d ⁷	Access on request to PNR elements the carrier holds ⁷
Canada ⁸	CBSA API/PNR program ⁸	Kept three and a half years, shared case by case for terrorism or serious transnational crime ⁸
DR Congo ¹⁰	Memorandum with UNOCT, 23 April 2024 ¹⁰	Support to build capacity on API and PNR and a roadmap for goTravel ¹⁰

Common questions

Does PNR include my religion or health?

The EU directive bars processing them and requires the PIU to delete them immediately ².

How long is my PNR kept?

Five years under the EU directive ². The Court of Justice limited retention after six months to passengers with objective evidence of risk ⁴. Canada keeps it three and a half years ⁸.

Who helps states build PNR systems?

The UN Countering Terrorist Travel Programme gives software and training. It works with 91 member states ⁹.

Can PNR rules cover flights inside the EU?

Yes, if a state notifies the Commission ². The Court of Justice said it needs a genuine and present or foreseeable terrorist threat to cover all such flights ⁴.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.

Sources

Advance Passenger Information (API) explained
What API data is, which fields airlines send, who receives it, the legal basis, how long it is kept, and examples from four jurisdictions.
API and PNR compared
How Advance Passenger Information differs from Passenger Name Record data in source, fields, timing, recipient, legal basis and retention.
The EU PNR Directive (Directive (EU) 2016/681)
What the EU PNR Directive requires of airlines and Member States, the 19 data elements it covers, retention rules, and what the EU Court of Justice ruled.
Passenger Information Units
What a Passenger Information Unit does with API and PNR data, the EU rules that govern it, the limits set by the EU Court of Justice, and examples.
Passenger data retention
How long governments keep PNR, API and biometric records about air travellers, what must be masked or deleted, and what the EU Court of Justice ruled.
Sharing passenger data with foreign governments
How PNR agreements let the US, Canada, Australia and the UK receive EU passenger data, how long they keep it, and the limits on passing it on.