Passenger name record (PNR) data

What PNR data contains

The European Commission says PNR data is information provided by passengers and held by air carriers for their own commercial purposes ¹. It can include travel dates, the full itinerary, contact details, payment information, seat number and baggage information ¹.

IATA defines PNR as reservation data held within airline reservation systems, covering items such as itinerary, contact details, ticketing and baggage data ⁴. The EU PNR Directive lists 19 categories of PNR data in its Annex I, as far as air carriers collect them ³.

How PNR differs from API

API is a narrower, standardised set of data such as travel document details, nationality, date of birth and flight information. Carriers collect it at check-in ¹. PNR is booking data, created when a trip is reserved ⁴.

The Commission says API mainly supports border management, and PNR is mainly a law enforcement tool ¹. Authorities use PNR analysis to identify criminals and terrorists, including people previously unknown to law enforcement ¹.

Global rules on PNR

UN Security Council resolution 2396 (2017), paragraph 12, decides that Member States shall develop the capability to collect, process and analyse PNR data, with full respect for human rights ⁵.

ICAO says resolution 2396 urged it to establish a standard for the collection, use, processing and protection of PNR data ². ICAO set up a PNR Task Force in March 2019. The Council adopted Amendment 28 to Annex 9 on 23 June 2020. It took effect on 30 October 2020 and became applicable on 28 February 2021 ².

Amendment 28 holds 11 Standards and 6 Recommended Practices on PNR. Standard 9.24 sets the baseline commitment for States to develop the capability to collect, use, process and protect PNR data ⁶.

PNR in the European Union

Directive (EU) 2016/681 covers the transfer by air carriers of PNR data of passengers on extra-EU flights ³. A Member State may extend it to intra-EU flights by notifying the Commission in writing ³. Each Member State sets up a passenger information unit (PIU) to process the data ³.

Carriers send PNR data 24 to 48 hours before scheduled departure and again after flight closure ³. The PIU keeps it for five years and depersonalises it after six months ³. On 21 June 2022 the EU Court of Justice held that a general five-year retention period is precluded for passengers with no objective evidence of risk ⁷.

EU PNR agreements with other countries

The European Commission lists these agreements and talks on its PNR page, accessed 24 October 2026 ¹.

Data protection points

IATA says passenger data should be collected for specified and legitimate purposes and kept only as long as necessary ⁴. It says decisions with significant consequences should not be based solely on automated analysis of PNR data ⁴.

The EU Court of Justice ruled in 2022 that a PIU may not use artificial intelligence in self-learning systems that could change assessment criteria without human review ⁷.