Border control at Schengen area airports: what happens to travellers and their data

Arriving: the steps at the border

The Schengen area has no internal border controls, and the SIS helps make up for that ⁸. At the first Schengen airport, national border guards check every non-EU traveller. They register short-stay visitors in the EES, an automated system that covers 29 European countries ¹.

The EES records the traveller's name, travel document data, fingerprints, facial image and the date and place of each entry and exit. It records refusals of entry too. Since 10 April 2026 it has replaced the stamping of passports. It detects overstayers automatically ¹.

The Commission set 12 October 2025 as the start of a progressive rollout. The system became fully operational on 10 April 2026 ¹. A law firm briefing reported that temporary measures letting states scale back EES registration during heavy congestion expired on 6 September 2026 ⁶.

eu-LISA, the EU agency that runs large IT systems, estimates that 1.3 billion border crossings a year fall under the EES ³.

Entry permission: Schengen visa or ETIAS

Citizens of countries on the EU visa list need a Schengen short-stay visa. It covers stays of up to 90 days in any 180-day period. Travellers apply at the consulate of the country they will visit, or of the country where they will spend longest. Applications go in at least 15 days and no more than 6 months before the trip. Fingerprints are taken when the application is lodged ⁷.

As of 2 December 2025, the visa fee is €90 for adults and €45 for children aged 6 to 12. Lower fees apply to applicants from Armenia, Azerbaijan, Belarus and Cabo Verde. Processing normally takes 15 days and can take up to 45 ⁷.

ETIAS will be a pre-travel authorisation for visa-free travellers visiting 30 European countries ⁴. Frontex says citizens of 59 visa-free countries will need it ⁵. The Commission page says ETIAS is not in operation, no applications are collected, and the EU will announce a start date several months ahead. The fee has been set at €20 and takes effect when ETIAS opens ⁴.

Frontex pages still refer to a start in the last quarter of 2026 ⁵. A Newland Chase briefing of 9 September 2026 reported that the official ETIAS portal had dropped that window and that press reports pointed to 2027. It noted that the Commission formally sets the start date ⁶.

Biometrics and automated gates

The EES Regulation says four fingerprints of each visa-exempt traveller should be registered where physically possible, along with a facial image of every traveller ². Children under 12 are exempt from giving fingerprints ².

Visa holders already gave fingerprints at the consulate ⁷. The Commission says the EES allows wider use of automated border control and self-service systems ¹. Which airports offer eGates or kiosks, and to whom, differs from country to country. This page does not list them.

Passenger data: API and PNR

The PNR Directive of 2016 requires each EU state to set up a passenger information unit (PIU). Airlines send PNR twice: 24 to 48 hours before departure and again right after the flight closes. The PIU may assess passengers against databases and pre-set criteria before arrival or departure. A person must review any automated match ¹⁰.

PNR is kept for five years. After six months, names, contact details and other identifying fields are masked. Applying the directive to flights inside the EU is optional. States had to put it into national law by 25 May 2018 ¹⁰.

On 21 June 2022 the Court of Justice of the EU upheld the directive in the Ligue des droits humains case but read it narrowly. It said PNR use must be limited to terrorism and serious crime with a link to air travel. It said intra-EU flights can be covered in full only when a state faces a genuine and present or foreseeable terrorist threat. Assessment criteria cannot rely on self-learning machine learning systems ¹¹.

A new API Regulation, (EU) 2025/12, applies to all flights into the EU. Airlines will send API through a central router built by eu-LISA. Data must be deleted from the router once transmission is confirmed. The regulation was published on 8 January 2025 and applies from a later date tied to the router ¹².

Watch lists and checks

The SIS lets police, border guards and other authorities enter and check alerts on people and objects in one shared database. It has run since 1995. The second generation added fingerprints and photographs in 2013, and the system was renewed in March 2023. Each country runs a SIRENE Bureau to handle follow-up on alerts ⁸.

eu-LISA reported on 25 May 2026 that authorities ran more than 17.7 billion SIS searches in 2025. At the end of 2025, SIS held over 94.6 million alerts, nearly 2 million of them on people. States reported nearly 365,000 hits on foreign alerts, and there were more than 13.1 million biometric searches ⁹.

Once ETIAS runs, applications will be checked against SIS, the Visa Information System and the EES. Frontex expects about 97 per cent to be approved automatically. Carriers will refuse boarding to travellers without a valid authorisation ⁵.

Your data: the law, retention and your rights

EES records of travellers who leave on time are kept for three years. Records of refused travellers are kept for three years too. Records of overstayers are kept for five years ². The regulation provides rights of access, rectification, completion, erasure and redress ².

National data protection authorities and the European Data Protection Supervisor (EDPS) supervise SIS, the Visa Information System, the EES and ETIAS together through the Coordinated Supervision Committee ¹³. The ETIAS Fundamental Rights Guidance Board includes the EDPS, the European Data Protection Board and the EU Agency for Fundamental Rights ⁵.

PNR data sits with the national PIU for five years ¹⁰. Requests for PNR, EES or SIS records start with the authority of the state that entered the data ^2,10. Our page on who keeps your passport data explains how to make a request.

Who runs the systems

eu-LISA develops and manages the EES and builds the ETIAS system ^1,4. It manages the central SIS infrastructure ⁹ and is building the API router ¹². Frontex hosts the ETIAS Central Unit, which sets screening rules and runs around the clock. Each of the 30 ETIAS countries will run a National Unit ⁵. The European Commission sets start dates ^1,6. Border guards, consulates and PIUs are national bodies ^7,10.

Security screening on departure

Regulation (EC) 300/2008 sets common rules for aviation security, covering screening of passengers, cabin bags and hold bags. Implementing Regulation (EU) 2015/1998 holds the detailed measures. Each state names a single aviation security authority. The same rules apply in Norway, Iceland, Liechtenstein and Switzerland ¹⁴.

The standard liquid rule allows containers of up to 100 millilitres in one transparent resealable one-litre bag. Medicines, special diets and baby food are exempt. Sealed duty-free bags are allowed under set conditions ¹⁵.

Some airports installed explosive detection systems that let passengers carry larger containers. From 1 September 2024, the Commission returned those airports to the 100 ml limit. It said the cause was a technical issue, not a new threat ¹⁶. Travellers should check the rule at each airport.

How national rules differ

Schengen rules are shared, but much is run nationally. Visa applications go to national consulates ⁷. Each state runs its own PIU and decides whether to cover intra-EU flights, within the limits set by the Court of Justice ^10,11. ETIAS refusals will be decided by National Units ⁵. Airport screening is overseen by a national authority ¹⁴. Our page on data protection by country covers national regulators.