Passenger Data Explained
Menu

Where passenger data is hosted

Last checked: 21 October 2026 · How passenger data works

Where passenger data is hosted means the servers and data centres that store traveller records and the country they sit in 1,2. EU law requires the storage, processing and analysis of PNR data to take place only in secure locations inside EU Member States 1. The EU Entry/Exit System runs in technical sites of the EU agency eu-LISA 2,3. Kenya's Data Protection Act lets a Cabinet Secretary require some processing to run on servers or data centres in Kenya 4.
EU PNR location rule
Article 6(8), Directive (EU) 2016/681 1
EES host
eu-LISA technical sites 2
eu-LISA locations
Headquarters in Tallinn, operational site in Strasbourg 3
Kenya localisation power
Section 50, Data Protection Act 2019 4
Philippine rule
Controller stays accountable for data sent to third parties, including abroad 5

Why hosting matters

The Philippine Data Privacy Act of 2012 keeps the controller responsible for personal information transferred to a third party for processing, whether domestically or internationally 5. The controller must use contractual or other reasonable means to provide a comparable level of protection 5.

A US audit shows what happens when copies leave the official system. The DHS Office of Inspector General found that during a 2019 CBP facial recognition pilot, subcontractor Perceptics, LLC transferred copies of traveller images to its own company network 6. That network was hit by a ransomware attack 6. The prime contractor was Unisys Corporation 6.

EU rules on location

Article 6(8) of the EU PNR Directive says storage, processing and analysis of PNR data by a Passenger Information Unit shall be carried out exclusively within a secure location or locations within the territory of the Member States 1.

For the Entry/Exit System, Article 7(2) of Regulation (EU) 2017/2226 says the Central System shall be hosted by eu-LISA in its technical sites 2. eu-LISA says its staff are located mainly at its headquarters in Tallinn and its operational site in Strasbourg 3.

National localisation rules

Section 50 of Kenya's Data Protection Act 2019 lets the Cabinet Secretary prescribe, on grounds of strategic interests of the state or protection of revenue, types of processing that shall only be done through a server or data centre located in Kenya 4. Section 48 sets the conditions under which a data controller or processor may transfer personal data to another country 4.

The Philippine law does not use the words outside the Philippines. It speaks of transfers made internationally, subject to cross-border arrangement and cooperation 5.

Donated and vendor systems

The UN Office of Counter-Terrorism (UNOCT) deploys its goTravel software free of charge, with support and maintenance, to collect and process passenger data 7. Its programme page does not say where the data are hosted or who owns them 7.

In the Philippines, UNOCT announced on 20 March 2025 that the UN-owned goTravel software was in full production, with funding from the Government of Australia 8. The release names the Department of Justice and the Bureau of Immigration as partners and does not state where the system is hosted 8.

Questions to check in any record

  • Does the law name a location for storage, as the EU PNR Directive does 1?
  • Has a minister used a power such as Kenya's section 50 to require local servers 4?
  • Does the contract say whether a contractor may copy data to its own network, the issue in the 2019 CBP case 6?
  • Who stays accountable when a third party processes data abroad 5?

Common questions

Must EU passenger data stay in the EU?

PNR data processed by a Passenger Information Unit must be stored, processed and analysed only in secure locations within the territory of the Member States 1.

Where is the EU Entry/Exit System hosted?

The Central System is hosted by eu-LISA in its technical sites 2. eu-LISA has its headquarters in Tallinn and an operational site in Strasbourg 3.

Does Kenya require passenger data to stay in Kenya?

Section 50 of the Data Protection Act 2019 lets the Cabinet Secretary require some processing to run on servers in Kenya 4. We could not confirm a rule naming passenger data.

Who hosts the UN goTravel system?

UNOCT pages say the software is UN-owned and donated, but do not say where the data are hosted 7,8.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.

Sources

  1. EUR-Lex: Directive (EU) 2016/681 on the use of passenger name record data (27 April 2016)
  2. EUR-Lex: Regulation (EU) 2017/2226 establishing an Entry/Exit System (2017)
  3. eu-LISA: Organisation
  4. Kenya Law: Data Protection Act No. 24 of 2019 (assented 8 November 2019)
  5. National Privacy Commission: Republic Act No. 10173, Data Privacy Act of 2012 (15 August 2012)
  6. DHS Office of Inspector General: Review of CBP's Major Cybersecurity Incident during a 2019 Biometric Pilot, OIG-20-71 (21 September 2020)
  7. UN Office of Counter-Terrorism: Countering Terrorist Travel Programme
  8. UNOCT: UNOCT and the Philippines celebrate the launch of the UN goTravel software (20 March 2025)

Related