Border control at Spain airports: what happens to travellers and their data

Arriving: the steps at the border

Non-EU nationals on a short stay are registered in the Entry/Exit System (EES) at the external border. It records name, travel document data, fingerprints, facial images and the date and place of entry and exit. Since 10 April 2026 it has replaced passport stamping ¹.

Spanish consulates list the entry conditions under the Schengen Borders Code. Travellers must enter at an authorised crossing point with a valid travel document. The passport must be valid until three months after the planned departure from Schengen and must have been issued in the previous ten years. Travellers must not be subject to an entry ban ³.

Border officers may ask for proof of the purpose of the stay, such as a return ticket, a hotel booking or a letter of invitation. They may ask for proof of funds. The consulate page gives the 2020 figure of €90 per person per day, with a minimum of €810 whatever the length of stay ³.

Entry is refused to travellers who do not meet the conditions, who face an entry ban, or who have already used their 90 days in the previous 180. A refusal comes as a reasoned decision with information on how to appeal. An appeal does not suspend the refusal ³.

Entry permission: Schengen visa or visa-free travel

Nationalities that need a visa are listed in Annex I of Regulation (EU) 2018/1806. No visa is needed by a traveller with a valid residence permit or long-stay visa issued by a Schengen state ³.

A Schengen visa is lodged at the consulate of the main destination. As checked on 19 October 2026, the fee is €90 for adults and €45 for children aged 6 to 12. Applicants from Armenia, Azerbaijan and Belarus pay €35 and applicants from Cabo Verde pay €67.50. Processing normally takes 15 days and can take up to 45 ².

Biometrics and eGates: ABC System

Spain calls its automated border gates the ABC System. In December 2017 the airport operator Aena said the units carry out a document check together with a facial check, a fingerprint check or both. A traveller passes the border in about 20 seconds ⁴.

Aena said at the time that the gates were for people over 18 holding a Spanish electronic identity card (DNIe) or an electronic passport and resident in a Schengen country ⁴.

In 2017 about 80 ABC units were installed at arrivals in six Aena airports: Madrid-Barajas, Barcelona-El Prat, Palma de Mallorca, Málaga-Costa del Sol, Alicante-Elche and Tenerife Sur ⁴.

On 28 December 2017 Aena awarded a €90 million framework agreement to buy up to 652 ABC units over four years for the 22 airports with the most international traffic. Aena said the move responded to Regulation (EU) 2017/458, which requires systematic checks of all persons on entry and exit. The four selected suppliers were Everis, Telefónica Ingeniería de Seguridad, Indra Sistemas and Informática El Corte Inglés with Gemalto. Bidders needed a certificate from the National Police to prove the equipment works with its systems ⁴.

Passenger data: API and PNR

Organic Law 1/2020 of 16 September 2020 transposes Directive (EU) 2016/681. It was published on 17 September 2020 and took effect on 17 November 2020 ⁵.

The law covers international flights both inside and outside the EU that leave Spain, arrive in Spain or stop there, including transit and connecting passengers. It covers commercial and private flights. It does not cover state aircraft or aircraft chartered by the state for military or other non-commercial state services ⁵.

The data includes the booking reference, booking and travel dates, names, address, phone and email, all payment data, the full itinerary, frequent flyer details, travel agent, check-in status and baggage information ⁵.

Airlines send the data twice: between 48 and 24 hours before scheduled departure, and once the flight is closed. Changes of destination during the flight must be sent too. In response to a real and specific threat, the unit can ask for data at other times ⁵.

The Spanish passenger information unit (UIP) sits inside the Intelligence Centre for Counter-Terrorism and Organised Crime (CITCO), which reports to the Secretary of State for Security in the Interior Ministry. The UIP is the controller of the PNR data ⁵.

The UIP keeps the data for five years. After six months, names, contact details, payment data and other identifying items are masked. Full access then needs approval from a judge or from the Secretary of State for Security ⁵.

Watch lists and checks

The UIP compares PNR data with all available and relevant databases for preventing and prosecuting terrorism and serious crime. It processes the data against pre-set criteria. Any automated hit must be checked by hand. The criteria may not be based on racial or ethnic origin, political opinions, religion, union or party membership, health or sex life ⁵.

The UIP shares data with other EU passenger information units only after a case-by-case analysis, using Europol's SIENA secure network. Transfers to countries outside the EU are allowed in specific cases and under conditions set in the law ⁵.

At the border, travellers subject to an entry ban are refused entry ³.

Your data: the law and how to ask for records

The UIP must appoint a data protection officer. That officer is the single contact point for anyone with a question about how their PNR data is processed ⁵.

Organic Law 1/2020 names the Spanish Data Protection Agency (AEPD) as the national supervisory authority for PNR. It handles complaints and checks that processing is lawful ⁵.

Police processing of personal data in Spain falls under Organic Law 7/2021 of 26 May 2021. It gives a right to confirm whether data is processed and to know the purposes, recipients and retention period ⁶.

The controller can delay, limit or refuse access when needed to protect investigations, public security or national security. In that case the person can exercise their rights through the data protection authority. The authority must report that it carried out the necessary checks and explain the right to appeal to the courts ⁶.

Who runs the systems

The National Police runs border checks at Spanish airports. Aena, the airport operator, buys and installs the ABC units for the police in agreement with the Interior Ministry and the Directorate General of Police ⁴.

The UIP within CITCO runs the PNR system ⁵. The State Aviation Safety Agency (AESA) certifies the security staff who carry out aviation security checks ⁸.

Security screening on departure

Aena hires private security companies for its airports. In July 2023 it said ten companies and joint ventures had bid for the security contract covering its 46 airports and two heliports in Spain, split into 13 lots. The contract was initially set at four years with an optional fifth year ⁷.

Aena said it would install EDSCB scanners during the contract so that passengers would not need to take out electronic devices or liquids. It said it would invest €1,170 million in physical security equipment between 2018 and 2028 ⁷.

On 21 October 2020 AESA approved a national exam system to certify security guards who carry out aviation security checks. The certificates are C1, C2, C3a and C3b under the National Civil Aviation Security Training Programme. Some exams include a practical test on reading X-ray images. Aena provides exam rooms at its airports ⁸.