EES Data Protection 2026: What Is Stored and For How Long

EES data protection rules cover four fingerprints, a facial image, your passport details, and a digital log of every entry and exit — held for three years after your last departure, or five if you overstay. The Entry/Exit System has recorded this data at Schengen borders since it became fully operational on 10 April 2026. This guide explains exactly what is stored, for how long, who can see it, and how to exercise your rights.

TL;DR: EES stores biometrics (four fingerprints plus a facial photo), passport data, and time-stamped entry/exit records in a central EU database run by eu-LISA. Standard retention is three years after your last exit; it rises to five years after an overstay or refused entry. You can ask to access, correct, or delete your record.

Quick Facts (EES data, 2026)	Perincian
Biometrics stored	4 fingerprints + facial image
Other data	Passport details, entry/exit dates, border location
Standard retention	3 years after last exit
After an overstay/refusal	5 tahun
Central operator	eu-LISA (EU agency)

Key facts at a glance:

• EES was created by EU Regulation 2017/2226 and became fully operational on 10 April 2026.
• The system records four fingerprints and a facial image for travellers aged 12 and over (eu-LISA, 2026).
• Records are kept for three years after your last exit, or five years following an overstay or refused entry.
• The database is centralised and managed by eu-LISA, the EU agency for large-scale IT systems.
• EES data is separate from the data ETIAS will collect when that system opens later in 2026.

Knowing what sits in your file helps you travel with fewer surprises. For the bigger picture of how the border check itself runs, our explainer on bagaimana EES berfungsi dengan ETIAS sets the scene before you dig into the privacy detail below.

What data does EES store about you?

EES stores four categories of data: biometrics (four fingerprints and a facial image for anyone aged 12 or over), passport and biographic details, a time-stamped record of each entry and exit with the border location, and any refusal of entry. Younger children give a facial image but no fingerprints. Nothing about your reason for travel or your finances is recorded.

Think of it as a border logbook rather than a profile. When a couple from Toronto lands in Madrid, the system captures their fingerprints and photo, ties them to passport numbers, and stamps a digital timestamp: entered Madrid, 8 July 2026, 14:12. On the way out three weeks later, it logs the exit. The official EES pages list these same categories. There is no browsing history, no bank data, no social media — just identity, document, and movement.

Because the record is biometric, it is tied to a person, not a passport booklet. Renew your passport and the file follows you; the new document number is linked on your next crossing. If you want to see how this differs at various crossing points, our guide on lapangan terbang berbanding sempadan darat covers where the capture actually happens.

How long does EES keep your data?

EES keeps your record for three years from the date of your last exit from the Schengen area. If you overstay the 90-day limit or are refused entry, retention rises to five years. Each new trip within the window refreshes the clock, so a frequent traveller effectively keeps one rolling record rather than a stack of separate files.

Retention has a purpose: it lets border systems calculate your days under the Peraturan 90/180 hari across trips. Say you visit twice in one year — March and September. Because the March record is still live, the September officer can see you have days left without asking you to prove it. After three clean years with no travel, the file is deleted automatically.

Petua profesional: If you were once refused entry or flagged for an overstay, that five-year record can affect later crossings. It is worth requesting a copy of your data before a big trip so you know what an officer sees — and can correct anything wrong before it causes a delay.

The rules on timing come straight from the EES Regulation, not from individual countries. That means the same three-year and five-year limits apply whether you enter through air, land or sea. For a sense of what an overstay actually triggers, see our note on Penalti overstay Schengen.

Who can access your EES data — and your rights

Border guards, visa authorities, and immigration officers can consult EES data to do their job. Police and Europol may access it for serious crime and terrorism cases, under strict conditions and logging. As the data subject, you have the right to see your record, correct errors, and request deletion of anything unlawfully stored, under EU data protection law.

Exercising those rights follows a set path:

1. Contact the national data protection authority or border agency of any Schengen country you entered through.
2. Prove your identity — usually a passport copy — so no one else can pull your file.
3. Ask specifically to access, correct, or delete data, and keep the written reference number they issue.

Every access to your record is itself logged, which is a safeguard, not a bug. eu-LISA, as the central operator, keeps audit trails so misuse can be traced. If an officer in Athens looks up your entry history, that lookup leaves a mark. This is the same GDPR backbone that protects EU residents, extended to the border. The Commission’s smart borders page spells out the legal basis.

Prefer not to wrestle with an ETIAS form once that system opens later in 2026? Our team can check your details and submit the application for you — a relief if you are helping older parents or a group travel. europe-visa.eu is an independent information and assistance service, not a government body; you can apply directly on the official EU portal (€20, under-18s free), or use our review and support.

EES data protection vs ETIAS data: two files, two systems

EES data protection covers biometrics and border movements captured when you arrive. ETIAS, a separate system not yet live, will collect application data — name, passport, background questions — before you travel, and store an authorisation linked to your passport for three years. The two databases talk to each other at the border but hold different information for different reasons.

A quick contrast helps. EES answers the question “did this person cross, and when?” ETIAS answers “is this person pre-cleared to travel?” One is a record made at the kiosk; the other will be an online permit you buy in advance. The EU expects ETIAS to open in the last quarter of 2026 at €20, with under-18s and over-70s exempt from the fee. Until then, no site can sell you a real ETIAS — treat any that claims to as a scam. Our EES vs ETIAS explainer dan Portal rasmi ETIAS keep the two straight.

What EES data protection means for your next trip

For most travellers, EES data protection changes little day to day: you give biometrics once, the record is reused for three years, and you can ask to see or fix it. The practical wins are knowing your file exists, checking it before an important trip, and understanding that an overstay leaves a longer trace. Keep your passport current so the record stays linked.

Before you fly again, three habits pay off. First, register calmly on your first crossing — rushing the fingerprint step just means a retry. Second, if you have ever been refused entry, request your data early. Third, when ETIAS opens, prepare that authorisation separately. Our Panduan permohonan langkah demi langkah, yang 2026 cost guide, and the senarai semak dokumen cover the paperwork, while the Q4 2026 timeline tracks the launch date.

Soalan yang kerap ditanya

What does EES data protection actually cover?

EES data protection covers your biometrics (four fingerprints and a facial image for ages 12 and over), passport and biographic details, and a time-stamped log of every entry and exit. It does not record your reason for travel, finances, or any browsing data.

How long is my EES data stored?

Standard retention is three years after your last exit from the Schengen area. If you overstay the 90-day limit or are refused entry, the record is kept for five years. A new trip within the window resets the three-year clock.

Where is my EES data physically kept?

In a central EU database managed by eu-LISA, the EU agency for large-scale IT systems. National border authorities feed data into it and read from it, but the system itself is centralised, not split across countries.

Who can access my EES record?

Border guards, visa and immigration authorities use it routinely. Police forces and Europol may access it for serious crime or terrorism investigations under strict, logged conditions. Every lookup is recorded so misuse can be traced.

Can I see or correct my EES data?

Yes. You can request access, ask for corrections, or seek deletion of unlawfully held data through the national data protection authority of a Schengen country you entered. You will need to prove your identity, usually with a passport copy.

Is EES data protection the same as ETIAS data protection?

No. EES covers biometrics and border movements captured on arrival. ETIAS, still not live, will store pre-travel application data and an authorisation linked to your passport. They are separate systems with separate files.

Does an overstay change what happens to my data?

Yes. An overstay or a refused entry extends retention from three to five years and adds a flag to your record. That flag can be seen at future crossings, so it is worth resolving any dispute early.

Do children have EES data stored too?

Yes, but with less. Children under 12 have a facial image and passport data recorded, not fingerprints. From age 12, fingerprints are added. The same three-year retention applies to their records.

---

About the author: Anna Reinholt has written about European travel documents since 2017 and focuses on ETIAS and the EU’s new border systems. She helps families and older travellers understand what changing entry rules mean for their trips, step by step. Every guide is checked against official EU sources before publication.
Updated: 2026-07-08

Last updated: 2026-07-08 — verified against official EU EES and ETIAS sources.