Passenger Data Explained
Menu

Data sovereignty and border systems

Last checked: 21 October 2026 · Rules and oversight

On this site, data sovereignty means the legal rules on where border and passenger data is stored, who controls it, and when it may leave a country. Kenya's Data Protection Act lets the Cabinet Secretary require some processing to run on servers in Kenya 1. The UN goTravel system is operated by each state, and the UN says it will not see, store or retain national data 3. EU law hosts its API router at the EU agency eu-LISA 6.
Kenya localisation power
Section 50, Data Protection Act, 2019 1
Kenya localisation rule
Regulation 26, Legal Notice 263 of 2021 2
UN access to goTravel data
UN states it will not see, store or retain Member State data 3
EU API router host
eu-LISA designs, develops, hosts and manages it 6
EU PNR transfers to non-EU states
Case by case, under Article 11 conditions 7
Philippines transfer rule
Controller stays accountable for data sent abroad 9

Three questions behind the term

Data sovereignty questions in border systems come down to three points. Where is the data stored? Which body has legal control of it? Under what conditions can it be sent to another country? The answers come from national data protection law, regional law and the terms of the software a state uses 1,6 7.

Kenya: a localisation rule

Kenya's Data Protection Act, 2019 was assented to on 8 November 2019 and commenced on 25 November 2019. Section 50 says the Cabinet Secretary may prescribe, "based on grounds of strategic interests of the state or protection of revenue," certain processing "that shall only be effected through a server or a data centre located in Kenya" 1.

The Data Protection (General) Regulations, 2021, Legal Notice 263, apply that power. A controller or processor handling data for a strategic interest of the state must process it through a server and data centre in Kenya, or store at least one serving copy in a data centre in Kenya 2. The listed purposes include civil registration and legal identity systems, elections, public finance systems, protected computer systems under section 20 of the Computer Misuse and Cybercrime Act, 2018, basic education and health care 2.

The list in regulation 26(2) does not name passenger or border data. It opens with the word "includes" 2. Under regulation 26(3), the Cabinet Secretary may apply the same rule to a controller processing data outside Kenya after a breach, if it fails to act or does not cooperate with the Data Commissioner 2.

United Nations goTravel: software run by each state

goTravel is a reconfigured version of the Travel Information Portal (TRIP) system. The Netherlands donated TRIP to the UN on 26 September 2018 3. The UN gives goTravel to Member States free of charge so they can operate it within their own jurisdiction. The brochure states that the UN "will not see, store, or retain any data belonging to each Member State" 3.

The UN Countering Terrorist Travel Programme says it deploys goTravel free of charge and provides support and maintenance. It works with 91 Member States, of which 69 receive its full package of technical assistance 4.

On 20 March 2025, the UN Office of Counter-Terrorism said the Philippines was the seventh Member State to deploy and go live with goTravel, and the first in ASEAN. The Department of Justice and the Bureau of Immigration led the work. The press release does not say where the servers are located 5.

European Union: a central router under national control

Regulation (EU) 2025/12 sets up a central router for advance passenger information. eu-LISA designs, develops, hosts and technically manages it 6. The router is not meant to be a repository. Data are kept only as long as needed for transmission and deleted once transmission is confirmed. Air carriers must delete API data 48 hours after the router receives it 6.

Directive (EU) 2016/681 allows a Passenger Information Unit to transfer PNR data to a non-EU country only case by case and when the conditions in Article 11 are met. The receiving country may pass the data on only when strictly necessary and with express authorisation. The PIU's data protection officer must be informed of each transfer 7.

ICAO Standard 9.34 in Annex 9 deals with PNR transfers between states. In a proposal dated 12 January 2021, the European Commission said EU Member States should notify a difference on Standard 9.34. Its reason was that the standard was not clear enough to confirm that Member States could keep stricter transfer requirements 8.

Philippines: accountability follows the data

Section 21 of the Data Privacy Act of 2012 says each personal information controller is responsible for personal information under its control or custody. This covers data sent to third parties for processing in the Philippines or abroad 9. Section 4(e) excludes information needed to carry out the functions of a public authority, including law enforcement and regulatory agencies 9.

Common questions

Does Kenyan law require passenger data to be stored in Kenya?

Regulation 26(2) of Legal Notice 263 of 2021 does not name passenger data, but its list opens with "includes" 2. Section 50 of the Act lets the Cabinet Secretary prescribe further processing that must run on servers in Kenya 1.

Does the UN hold passenger data processed with goTravel?

The UN states that it "will not see, store, or retain any data belonging to each Member State" 3.

Who hosts the EU API router?

eu-LISA, the EU agency for large-scale IT systems, designs, develops, hosts and technically manages it 6.

Can EU PNR data be sent to a country outside the EU?

Yes, case by case and only under the conditions in Article 11 of Directive (EU) 2016/681 7.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email [email protected] with the official link.

Sources

  1. Kenya Law: Data Protection Act, 2019, Cap. 411C (commenced 25 November 2019)
  2. Office of the Data Protection Commissioner, Kenya: Data Protection (General) Regulations, 2021, Legal Notice 263 (31 December 2021)
  3. UN Office of Counter-Terrorism: Countering Terrorist Travel Programme, goTravel brochure (undated)
  4. UN Office of Counter-Terrorism: Countering Terrorist Travel Programme (page checked 21 October 2026)
  5. UN Office of Counter-Terrorism: press release on the launch of goTravel in the Philippines (20 March 2025)
  6. EUR-Lex: Regulation (EU) 2025/12 on advance passenger information for border management (19 December 2024)
  7. EUR-Lex: Directive (EU) 2016/681 on the use of passenger name record data (27 April 2016)
  8. Council of the EU: Commission proposal COM(2021) 16 on the EU position on Amendment 28 to ICAO Annex 9 (12 January 2021)
  9. National Privacy Commission, Philippines: Data Privacy Act of 2012, Republic Act 10173 (15 August 2012)

Related