Passenger Data Explained
Menu

UK passenger data rules: API, PNR, Border Force and the ETA

Last checked: 21 October 2026 · Rules and oversight

In the UK, carriers send passenger, crew and journey information to the Home Office under powers in the Immigration, Asylum and Nationality Act 2006 and the Immigration and Police (Passenger, Crew and Service Information) Order 2008 1,3. Section 36 of the 2006 Act requires immigration, customs and police bodies to share it 2. The Home Office keeps advance passenger information for 10 years and passenger name records for up to 5 years 7. Complaints go to the Information Commissioner's Office 7.
Main Act
Immigration, Asylum and Nationality Act 2006, sections 32 and 36 1,2
Data order
Immigration and Police (Passenger, Crew and Service Information) Order 2008, SI 2008/5 3
Controller
The Home Office 7
API retention
10 years 7
PNR retention
Up to 5 years, cut from 10 years on 17 April 2023 7
ETA legal basis
Section 11C, Immigration Act 1971, inserted by the Nationality and Borders Act 2022 4
ETA fee
£20 5
Complaints
Information Commissioner's Office, 0303 123 1113 7

The legal powers

Section 32 of the Immigration, Asylum and Nationality Act 2006 lets a police officer of superintendent rank or above require the owner or agent of a ship or aircraft arriving in or leaving the UK to provide passenger and crew information 1. A requirement must be in writing and last no more than six months. The kinds of information are set by an order of the Secretary of State, subject to annulment by either House of Parliament 1.

Section 36 places a duty to share information on immigration officers, designated customs officials, the Secretary of State, chief police officers and HM Revenue and Customs, where it is likely to be useful for immigration, police or customs purposes 2. The Counter-Terrorism and Security Act 2015 amended section 32 on 12 February 2015 1.

Which data fields carriers send

SI 2008/5 has separate schedules for immigration purposes (Schedules 1 and 2) and police purposes (Schedules 3 and 4). Schedules 1 and 3 cover crew, passengers and the voyage or flight 3. Schedules 2 and 4 cover passenger and service information to the extent known by the carrier 3.

  • Reservation names, place of birth, address, sex, phone number and email 3
  • Check-in status and time, seat, class, baggage and ticket details 3
  • Booking date, travel agent, co-travellers, full itinerary, code share and PNR locators, with the history of changes 3
  • Payment method, card numbers and billing address 3
  • Extra details for unaccompanied passengers under 18, including guardian names and contact details 3

Retention periods

The Home Office borders privacy notice was last updated on 6 August 2026. It records that the PNR retention period was reduced from 10 years to 5 years on 17 April 2023 7.

DataRetention [7]
Advance passenger information10 years 7
Passenger name recordsUp to 5 years 7
Border images, British citizens and right of abode holders30 days 7
Border images, foreign nationals6 years 7
ETA facial biometricsTypically 3 years 6
ETA biographic and personal data15 years after the last case action 6

Electronic travel authorisation (ETA)

Section 11C of the Immigration Act 1971 lets immigration rules require some travellers to hold an electronic travel authorisation before travelling to the UK. The Nationality and Borders Act 2022 inserted it on 28 June 2022 4. British citizens are exempt 4.

An ETA costs £20 and allows travel to the UK, Jersey, Guernsey or the Isle of Man for up to 6 months. Each traveller needs one, including babies and children 5. The ETA privacy notice, dated 13 November 2025, says the Home Office processes facial images and biographic data from applications under UK GDPR Article 6(1)(e) and Article 9(2)(g) 6.

Oversight: ICO and the Chief Inspector

The Home Office is the controller for borders and immigration data. People can complain about its handling of their data to the Information Commissioner's Office 7.

On 9 October 2013 the Independent Chief Inspector of Borders and Immigration published an inspection of e-Borders covering October 2012 to March 2013 8. It found that only 65% of passenger movements into and out of the UK were covered, and that e-Borders had cost £472m from 2007/08 to 2012/13 9. It reported shared system log-ins, which it called a serious breach of security, and found staff had no clear guidance on data retention. It made 14 recommendations 9.

In its response, Border Force accepted eight recommendations in full and four in part. Two were redacted 10.

Common questions

How long does the UK keep advance passenger information?

The Home Office privacy notice gives 10 years for advance passenger information 7.

How long does the UK keep PNR data?

Up to 5 years. The period was cut from 10 years on 17 April 2023 7.

Who regulates Home Office use of passenger data?

Complaints go to the Information Commissioner's Office, the route named in the Home Office privacy notice 7.

How long is ETA facial data kept?

Facial biometrics are typically kept for 3 years and biographic data for 15 years after the last case action 6.

Has an inspector reviewed UK passenger data systems?

Yes. The Chief Inspector's e-Borders report of 9 October 2013 made 14 recommendations 8,9.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.

Sources

  1. legislation.gov.uk: Immigration, Asylum and Nationality Act 2006, section 32
  2. legislation.gov.uk: Immigration, Asylum and Nationality Act 2006, section 36
  3. legislation.gov.uk: Immigration and Police (Passenger, Crew and Service Information) Order 2008, SI 2008/5, Schedule 2
  4. legislation.gov.uk: Immigration Act 1971, section 11C, electronic travel authorisations
  5. GOV.UK: Apply for an electronic travel authorisation (ETA)
  6. Home Office: Electronic travel authorisation privacy information notice (13 November 2025)
  7. Home Office: Borders, immigration and citizenship privacy information notice (6 August 2026)
  8. ICIBI: Inspection report on e-borders (9 October 2013)
  9. ICIBI: Exporting the border? An inspection of e-Borders, October 2012 to March 2013 (PDF)
  10. Border Force: Response to the Chief Inspector's e-Borders report (PDF)

Related