Who collects your travel data, who keeps it, and what the rules say

What access logs for passenger data must record, how long logs are kept, who may read them, and what an audit found when controls failed.

What API data is, which fields airlines send, who receives it, the legal basis, how long it is kept, and examples from four jurisdictions.

What airlines and their system providers collect, carrier duties and fines for API and PNR, and what airline privacy notices say.

How Advance Passenger Information differs from Passenger Name Record data in source, fields, timing, recipient, legal basis and retention.

Which fingerprints and facial images border agencies collect from travellers, the legal basis, who holds the records and how long they are kept.

How border systems record data on minors: API and PNR fields, fingerprint and face age limits in the EU, US and UK, eGate ages and consent letters.

What data cruise and ferry operators record and send to governments under the IMO FAL Convention, EU, US and UK rules, and how long it is kept.

What US ESTA, UK ETA, Canada eTA, Kenya ETA, EU ETIAS and India e-Visa collect from travellers, and how long the data is kept.

How border e-gates match a traveller's face to a passport or a stored gallery, what images are kept, who runs the gates and where they are used.

How interactive Advance Passenger Information lets border authorities answer board or no-board at check-in, with US, Canadian and UK examples.

What counts as a passenger data breach, who must be told and how fast, and what a US audit found after border biometric images were stolen.

How long governments keep PNR, API and biometric records about air travellers, what must be masked or deleted, and what the EU Court of Justice ruled.

What PNR data is, the 19 EU data elements, who sends and receives it, the legal basis, retention rules and the 2022 EU Court of Justice ruling.

How border agencies check API and PNR data against watch lists and risk rules, what EU law and the Court of Justice allow, and how hits are reviewed.

What UN goTravel does with API and PNR data, which countries use it per UN pages, who hosts the data, how it is deployed and who oversees it.

How API and PNR data are compared with INTERPOL, national and UN lists, what happens after a hit, how false matches are handled and how to seek redress.

Where governments store API, PNR and biometric passenger records, what laws say about servers and location, and how donated and vendor systems fit in.

Who decides why and how API and PNR data are processed, who processes them on instructions, and how EU, Kenyan and Philippine law split the roles.

Where border and passenger data must be stored, who can reach it, and what Kenyan, EU, Philippine and UN rules say about hosting and transfer.

What the EU Entry/Exit System and ETIAS collect, official start dates, how long data is kept, eu-LISA's role and EDPS supervision.

Official routes to ask for your API, PNR and border records in the EU, UK, US, Canada and Kenya, and what an authority may withhold.

How ICCPR Article 17, UN human rights bodies, the EU Court of Justice and the European Court of Human Rights treat passenger data.

The terms that decide who holds passenger data in border systems: data location, fees, funding, gateway providers and what official records publish.

What a Passenger Information Unit does with API and PNR data, the EU rules that govern it, the limits set by the EU Court of Justice, and examples.

How PNR agreements let the US, Canada, Australia and the UK receive EU passenger data, how long they keep it, and the limits on passing it on.

What the EU PNR Directive requires of airlines and Member States, the 19 data elements it covers, retention rules, and what the EU Court of Justice ruled.

The UK law on passenger and crew information, the data carriers send, Home Office retention periods, the ETA, ICO complaints and inspection findings.

What Resolution 2396 (2017) asks of states on API, PNR, watch lists and biometrics, and how ICAO Annex 9 sets the passenger data standards.

How CBP's APIS, TSA's Secure Flight and the Automated Targeting System collect air passenger data, the legal basis, retention periods and audit findings.

The bodies that check how governments use API and PNR data: data protection authorities, data protection officers, courts and UN standards.

Argentina's data protection law, the AAIP, the API/PNR system set up in 2014, biometric migration control and an audit office report on DNM systems.

What Bangladesh law says about personal data, who regulates it, and where plans for an Advance Passenger Information System stand.

Brazil's LGPD, the ANPD, ANAC's API and PNR rules, Polícia Federal border control, Receita Federal risk analysis and automated gates.

Cambodia's draft Law on Personal Data Protection, the General Department of Immigration, the e-Arrival card and what is not yet published on API/PNR.

Chile's data protection laws, the new data protection agency, the 2026 law requiring airlines to send API and PNR data, and a Contraloría audit of PDI.

Colombia's Law 1581 of 2012, the SIC as regulator, Migración Colombia's API rules, the Check-Mig pre-registration form and Biomig biometric gates.

Côte d'Ivoire's 2013 data protection law, ARTCI, the 2025 API and PNR decree, the Securiport border contract, the e-visa and the airport security fee.

The DRC's 2023 Code du numérique, the status of its data protection authority, and the Securiport immigration system contract and US$30 fee.

Egypt's Personal Data Protection Law 151 of 2020, its executive regulations, the PDPC, API/PNR status, the e-visa portal and border data records.

Ethiopia's Personal Data Protection Proclamation 1321/2024, its regulator, the Immigration and Citizenship Service, e-visa data and API/PNR status.

What is on the public record about Ghana's API and PNR systems, the aviation security directive behind them, and the Data Protection Commission.

Guinea's Loi L/2016/037/AN on cybersecurity and personal data, the 2025 data security decree, the border police e-visa and fingerprint capture at Conakry.

Who receives airline passenger data in India, what the DPDP Act 2023 and Rules 2025 say, and how PNR, e-Arrival and Digi Yatra work.

How Indonesia handles traveller data: Law 27/2022 on personal data, the pending authority, the All Indonesia arrival card, API/PNR analysis and autogates.

What passenger data Kenya collects from airlines and travellers, which agency receives it, how long it is kept, and the US$4.95 API/PNR fee.

Liberia's pending data protection bill, the Liberia Immigration Service, the 2026 e-border pilot at Roberts International Airport and LACC findings.

How Malaysia governs traveller data: the PDPA 2010 and 2024 amendments, the Immigration Department's MyIMMs, autogates, MDAC and audit findings.

Mexico's 2025 data protection laws, the authority that replaced INAI, INM's electronic passenger list rules and an ASF audit of the ALEP system.

Morocco's data law 09-08, the CNDP, the DGSN passenger information centre decree, API/PNR status, airport gates and the e-visa portal.

Nepal's Privacy Act 2018, no data protection authority, the Department of Immigration, Nepali Port, the 2026 e-visa and CIAA cases.

How Nigeria collects advance passenger data, which agency receives it, what the Nigeria Data Protection Act 2023 covers, and where e-gates stand.

Where Pakistan's data protection bill stands, how the FIA Immigration Wing and IBMS work, NADRA's role, and the status of API and PNR.

Paraguay's 2025 data protection law, the agency it creates, and where the API/PNR project of the Dirección Nacional de Migraciones stands.

Peru's data protection law and 2024 regulation, the PNR system run by Migraciones, and the e-gates at Jorge Chávez airport.

How the Philippines collects advance passenger data, what the Data Privacy Act says, and the status of e-gates and the CAISS border fee proposal.

Qatar's Law No. 13 of 2016 on personal data privacy, the NCSA data privacy office, Ministry of Interior e-gates, Hayya e-visas, and API/PNR status.

How Rwanda collects API and PNR data under Law No 006/2024, which agency holds it, how long it is kept, and who oversees personal data.

Saudi Arabia's Personal Data Protection Law and SDAIA, the National Travelers Security Center, e-visa data, and biometric collection for visitors.

Senegal's 2008 personal data law, the CDP, the airport biometric security fee collected for Securiport, and the contract's reported 2026 expiry.

Sierra Leone's planned data protection law, the Securiport airport security fee, its July 2026 suspension and special audit, and equipment records.

Who receives airline passenger data in South Africa, how the Border Management Authority uses it, and what the Auditor-General found about border systems.

Sri Lanka's Personal Data Protection Act and 2025 amendment, the Data Protection Authority, the ETA system and the 2024 e-visa court case.

Where Tanzania stands on API and PNR, the US$45 passenger facilitation fee, the Personal Data Protection Act 2022 and the immigration e-visa system.

How Thailand governs traveller data: the PDPA 2019, the Immigration Bureau's APPS and PNR order, the TDAC arrival card and Suvarnabhumi auto gates.

Data protection law status, the Securiport airport contract, National Audit Office findings and official and company responses in The Gambia.

Who collects air passenger data in Uganda, how customs screens API and PNR data, what the 2019 data protection law says, and how e-passports are issued.

The UAE personal data law and its exclusions, the UAE Data Office, ICP and GDRFA Dubai, biometric smart gates, and what is published on API and PNR.

How Vietnam governs traveller data: Decree 13/2023, the 2025 Personal Data Protection Law, Decree 27/2011 on API, the e-visa, PAI and autogates.

What Zambia's Data Protection Act 2021 says about personal data, the status of a planned advance passenger information system, and the e-visa portal.

Zimbabwe's Cyber and Data Protection Act, POTRAZ as data protection authority, the online border management system and the status of API and PNR.