Your Personal Data After an ETIAS Application: Storage, Access and Your Rights
Jul 11, 2026
Category: ETIAS ETIAS Tips
You press submit, an email confirms your unique application number, and your data is processed. Where does it go?
This guide traces who reads your file, how long it is stored, and what it means for UK travellers. With the European Travel Information and Authorisation System (ETIAS) launching in late 2026, no immediate action is required, but preparation is essential.
Your data determines whether your travel authorisation is granted, revoked, or annulled, and whether carriers will let you board. Crucially, ETIAS links directly to the Entry/Exit System (EES) records captured at Schengen borders; any mismatch between the two could result in you being stopped at the gate.
Everything You Hand Over on the Application Form
The form collects identity data, document details, travel plans and background declarations, all of which feed into the ETIAS central system.
Personal Details
Alongside standard border questions, the form requires your parents’ first names, your education level and your current occupation. This information forms part of the profile used to assess applications from third-country nationals under the ETIAS regulation.
- Full name(s) and surname
- Date and place of birth
- Sex and nationality/nationalities
- Home address, email and phone number(s)
- Parents’ first names
- Level of education and current occupation
Travel Documents and Journey Data
You must provide your exact passport details (number, issuing country and dates of issue and expiry) and your first intended destination country and address.
Note: Naming a first destination does not lock your itinerary. Once granted, your authorisation allows you to travel freely through the Schengen Area and any of the 30 ETIAS-requiring countries, even if you skip the country originally named.
Declarations Carrying Legal Weight
You must declare any criminal convictions, travel to conflict zones or past deportation orders before certifying that all information is correct.
Incorrect information—even if entered by a travel agent or family member—can lead to the refusal, revocation or annulment of your authorisation at the border.
Family Members of EU Nationals
If you declare a family tie to a citizen of the EU, Iceland, Liechtenstein, Norway or Switzerland, you must provide their personal details and specify the relationship.
This applies to many British travellers (e.g. a UK national married to a French citizen), but only if the relative is living in or travelling to a country other than their own, and you do not already hold a valid visa or residence permit. Falsely claiming this status can result in revocation and denied entry.
Where the Data Goes Once You Press Submit
Your application is stored in a central database managed by an EU agency, where it is automatically checked against other systems and screening rules. Most applicants receive a decision within minutes, and the file remains linked to their passport.
The central system
The technical operation of the database falls to eu-LISA, the EU agency responsible for large-scale IT systems in the area of freedom, security and justice. It keeps the system running and secure, and it does not decide whether you get your authorisation.
That decision sits elsewhere. When automated checks return a hit, the file is passed to the ETIAS central unit for verification and, if needed, to the ETIAS national unit of the country you named as your first intended stay.
The national unit is the body that grants or refuses. If your application is refused, the authorities of that country are the ones you appeal to.
What happens in the first minutes
The system runs your details against relevant databases and screening rules the moment you submit. This risk assessment is automated, and for most applicants, it completes before you close the browser tab.
Four things can happen next:
- Your authorisation is granted.
- Your application is refused, with the reasons set out in the email.
- You are asked to supply additional information or documentation.
- You are invited to an interview.
You should receive a reply within 96 hours telling you which of those applies. If you are asked for more information, you have 10 days to provide it, and a further decision will follow within 96 hours of your submission.
An interview is the longest route. It takes place online or at the consulate nearest your home, and the decision is made within 48 hours of the interview.
That is why the advice is to apply before you book flights or accommodation, not after. A last-minute application will probably be processed within minutes, but the process allows for delays you cannot control.
Draft applications
You do not have to finish the form in one sitting. Save it, walk away, come back to it later.
The system holds your draft for 48 hours. After that, it is automatically deleted, and you start again with a blank form.
When you save a draft for the first time, you receive an email containing a hyperlink. That link lets you delete the draft yourself, before the 48 hours run out.
Use it if you have been filling in the form on a shared laptop, a library computer or a work machine. A half-finished application contains your passport number, your home address and your parents’/ names, and there is no reason to leave it sitting there.
Who Can Read Your File
A defined set of authorities can see your application, and access depends on their role rather than their job title. Border guards, national authorities and three EU agencies fall inside that set, while airlines and travel agents see almost nothing.
The authorities with routine access
Access is limited to authorised personnel within a small number of EU bodies and the national authorities of the 30 ETIAS-requiring countries. These organisations include the system operator eu-LISA; Frontex, the European Border and Coast Guard Agency; and Europol.
Users can only access personal data relevant to their specific duties. These strict access rules are governed by Regulation (EU) 2018/1240 and are applied under national laws and EU data protection frameworks.
Border guards and the arrival check
Your file informs the decision made at the border. When you arrive, a border guard verifies that you meet entry requirements and may request documents supporting your answers to the application.
A valid authorisation does not guarantee entry. The border guard makes the final decision based on national law, security risks and the check’s findings.
Carriers and the boarding gate
Before you board, airlines, coach operators and ferry companies query the system to verify your authorisation status. Carriers only receive a “yes” or “no” answer; they cannot see your personal details, criminal declarations or background information.
Similarly, carriers can only verify whether short-stay visa holders have remaining entries under the EES.
You must travel with the exact passport used in your application. If your document does not match, the check fails, and you will be denied boarding.
What is not shared
Payment data is not stored in your file. Your card details are handled entirely by the financial intermediary, and the central system retains no payment information once the payment is cleared.
While not private, your file is a border management record protected by EU data protection standards. It is accessible only to authorities responsible for border checks, immigration and law enforcement.
The Payment Trail and the EUR 20 Fee
The fee costs EUR 20, you pay it by card, and the card details are never entered into your application record. Who pays and who does not turns out to affect more than your bank balance.
How the fee is taken
You need a payment card in front of you when you fill in the form. Several online payment options are available, and the fee is charged when you submit.
Card data goes directly to the processing bank or financial intermediary. The central system neither processes nor retains payment information once it has been cleared, meaning your card number remains entirely separate from your passport record.
Who does not pay
Applicants under 18 and applicants over 70 are exempt from the fee, though they still complete the same form.
Family members of EU citizens—and of non-EU nationals with free movement rights—are exempt under Directive 2004/38/EC. This exemption applies only if the relative is travelling to or residing in a country other than their own.
Applications with family-member status are not checked against the screening rules for irregular migration, so the assessment itself runs differently.
Claiming a status that does not apply to you is a false declaration. A Mexican citizen visiting a French spouse in France, for example, cannot claim it, because the directive does not cover a family member travelling to their relative’s own country of nationality.
You will need to prove the family tie at the border. Turn up without the documents, and you can be denied entry, with your authorisation revoked on the spot.
Intermediaries and additional charges
The official application costs EUR 20 and nothing more. A travel agency or a commercial website may add its own service charge, and every penny above EUR 20 goes to them rather than to any authority.
Ask what the extra covers before you agree to it. An intermediary who charges you an excessive amount or takes your money and never submits the application can be reported anonymously through the official channel.
The fee is non-refundable, regardless of the outcome. Apply, get refused, and you have spent the money.
That includes applications refused for reasons you could have avoided, such as a mistyped passport number or an inaccurate declaration about criminal records. You pay again when you reapply, so the incentive to check your form carefully is both financial and practical.
Nothing about the payment is stored under the data retention arrangements that apply to the rest of your application. Your bank keeps its own transaction records under its own data protection rules, and those sit entirely outside the border system.
Data Held Alongside Your Application by the EES
A second database records you every time you cross an external European border, and it already holds data on British travellers today. The EES logs your identity, your fingerprints or your photograph, and the date and place of each entry and exit.
A separate system with a separate purpose
The EES registers non-EU nationals travelling for a short stay, each time they cross the external borders of 29 European countries. It went live progressively from 12 October 2025 and has been fully operational since 10 April 2026.
It replaces passport stamping across most of Europe. Two exceptions remain: in Cyprus and Ireland, your passport is still stamped by hand.
The system applies whether you need a short-stay visa or travel visa-free. British passport holders fall inside it on both counts.
What is recorded at the border
Four categories of data go into your record. The first comes straight off your travel document: your full name, date of birth and nationality.
The second is your movement history. Every entry and exit is logged with a date and place, building a running travel history across all countries that require EES.
Third comes biometric data. That means a facial image, fingerprints, or both, captured at the border rather than supplied in advance.
Fourth, the system records information on refused entry where it applies to you. A refusal at one border is evident at the next.
Checking your own record
The count of days you have spent inside the 90 in any 180-day allowance is not something you have to track on a spreadsheet. An online tool tells you how many days you have left.
Some external border crossing points offer the same check on arrival. Use it before you book a longer trip, because overstaying is one of the things the system is built to detect.
Your data protection rights apply to this record. Guidance on accessing or rectifying your data is available at the EES website, and all information is collected and stored in full compliance with EU data protection rules.
Frequent travellers may qualify for something extra. Countries using the system can set up National Facilitation Programmes to speed up border crossings for non-EU nationals who travel to Europe often, and eligibility is checked through the same website.
A biometric passport opens another door. Where automated border control gates are available, holders of biometric passports can use them, which is faster than queuing for a booth.
How Long the Data Lasts
Your authorisation lives for three years, or until your passport expires, whichever comes first. Several things can cut it short before either deadline arrives.
The life of a granted authorisation
The three-year validity is a maximum ceiling, not a guarantee. Because your authorisation is tied directly to your travel document, its retention period is determined by your passport’s expiry date (e.g., a passport expiring in two years means a two-year authorisation).
Additionally, turning 18 does not invalidate an authorisation granted as a child; it remains valid until its original expiry date.
The events that end it early
A new passport requires a new authorisation, whether the old one has run out, been filled with stamps, or been damaged. The same applies if you change your name, surname, gender or nationality on a new travel document; the old authorisation becomes invalid, and you must reapply.
Reporting your passport as lost or stolen automatically cancels the linked authorisation. Even if you recover the document later, it cannot be reactivated; you must obtain a new travel document and apply for a fresh authorisation.
Revocation and annulment
Revocation applies if you no longer meet the entry conditions, while annulment applies if evidence shows you did not meet them when you applied, for example, by making false declarations.
Both decisions are emailed to you, along with the reasons and appeal instructions for the country that made the decision. If this occurs whilst you are in Europe, you lose your legal basis to stay, so always check your status before travelling rather than assuming it remains valid.
Depending on the cause, you may be able to reapply immediately; if your authorisation was revoked because you lost your passport, the issue is resolved once you have a new document.
You can also request to revoke your own authorisation at any time, though if you are currently in an ETIAS-requiring country, it only takes effect once you leave.
Your application email address is critical, as all notifications regarding expiry, revocation and annulment are sent there. Losing access to this inbox means you might only discover a problem at the boarding gate.
Correcting, Contesting and Controlling the Data
You have two routes to fix a mistake, and the right one depends on how serious the error is. Beyond corrections, you have rights of access and rectification to the data held about you, regardless of the passport you carry.
Mistakes discovered after submission
Reapplying is usually faster than asking for a correction. Take the data from your old application, fix the error and submit a new one.
That route is compulsory for substantial changes. A wrong nationality, a changed passport number, a new surname or an email address you cannot access all require a fresh application rather than an amendment.
Minor typos work differently. A small slip can be corrected by request, though processing takes up to 30 days, which is longer than most people have before a flight.
Leaving the error alone is the worst option. If the details in your travel document do not match those in your authorisation, you will be refused boarding and, if you somehow reach the border, refused entry.
Access and rectification rights
The data held about you is not a black box. You can request access to it and ask for inaccurate records to be rectified, with guidance available on the official EES website.
Those rights exist because your data is collected and stored in full compliance with EU data protection rules. The General Data Protection Regulation (GDPR) sets the applicable standards, and independent oversight is exercised by the European Data Protection Supervisor (EDPS).
Knowing who holds the data matters when you exercise a right. The national authority that decided your application acts as the relevant data controller for the decision, while the agency running the system handles the infrastructure.
Your protections do not weaken because you are a British national rather than an EU citizen. The fundamental rights framework applies to the processing itself, not to the passport of the person whose data is being processed.
Reviewing before you commit
Every problem in this section is easier to prevent than to fix. The form lets you review your answers and download a copy of the application before you submit it, so read it once more before you press the button.
Read the passport number character by character. Typing a zero where the letter O belongs, or the reverse, breaks the link between your document and your authorisation, and no border system will forgive the difference.
Check the email address too. Everything you are ever told about your authorisation, including any decision to revoke it, is sent to whatever address appears on that form.
Then check the spelling of your name against the passport itself rather than from memory. Middle names, hyphens and accented characters cause more refusals than dramatic mistakes do.
When Somebody Else Holds Your Data
You can authorise a friend, a relative or a travel agency to apply on your behalf, and doing so hands them your passport details, your home address and your declarations about your past. The responsibility for what they submit stays with you.
The declaration of representation
Nobody can apply on your behalf without a signed declaration of representation. Both of you sign it, and it authorises the third party to compile and submit your application.
The document covers applications for yourself, a minor under your parental authority, or a person under your legal guardianship. Applications for anyone under 18 must be submitted by a parent or legal guardian.
The declaration also authorises the third party to process your personal data. The rules governing that processing apply to you based on your country of residence.
One traveller, one declaration. A family of two parents, two children and one adult under legal guardianship needs five separate declarations, not one covering the household.
Get legal advice before signing if you are unclear about what powers you are granting. The declaration is a legal instrument, and the person who signs it is agreeing to hand over sensitive data.
What the third party must disclose
The form asks the third party to identify themselves by providing their name, organisation or firm (if applicable), contact details, relationship to you, and confirmation that both of you signed the declaration of representation.
That information becomes part of your application, recording who acted on your behalf and under what authority.
Protecting yourself
Keep a copy of the signed declaration. It proves what you authorised, and the third party should keep one too.
Review the draft before submission. Although the third party confirms your data on your behalf, you remain responsible for its accuracy.
Incorrect information can lead to refusal, revocation, or annulment and may stop you from boarding, regardless of who made the mistake.
Use your own email address in the application. It will receive all messages about your authorisation, including any revocation notices.
If an agent uses their own email, you lose direct access to status updates and may not learn of a revocation until you travel.
Choose a trusted representative. They receive sensitive passport details, and you can anonymously report anyone who overcharges you or accepts payment without submitting your application through the official channel.
Unofficial Websites and the Data They Collect
Search for the scheme today, and commercial websites will appear before the official one. They collect your passport details, charge more than the official fee, and give you nothing that the official route would not.
How copycat sites operate
Intermediary websites are not fake, which makes them confusing. They collect your information, then submit a genuine application through the official website on your behalf.
You pay for the middleman. Their fee is added to the EUR 20 official charge, but it does not provide priority, a faster decision or added status.
Travellers who have used the US ESTA will recognise the pattern. Similar lookalike websites emerged around that system, exploiting the gap between public awareness and the official launch.
ETIAS applications will not open until the system launches in the last quarter of 2026, so any site inviting you to apply today is collecting your data for a process that does not yet exist.
Assessing an intermediary before you hand over a passport
Some intermediaries are legitimate. For example, a travel agency applying on behalf of a corporate client provides a genuine service.
Before using one, check the quality of the service, what the extra fee covers, and how your personal data is protected.
Data protection matters because you are sharing sensitive information, including your passport number, home address, parents’ names and answers about criminal convictions.
Report any intermediary that abuses your trust. You can anonymously report excessive fees or the taking of payment without submitting your application through the official channel.
The single official route
The European Union operates one official website that accepts applications directly. It applies the highest data protection standards and charges only the EUR 20 official fee.
An upcoming official mobile app will offer the same service. Both submit your data directly without an intermediary retaining a copy.
You do not need to act yet. The EU will announce the start date several months before ETIAS begins operating.
Bookmark the official website now. Searching for it the night before your flight makes it easier to end up on a lookalike site charging far more.
What UK Nationals Specifically Need to Know
British passport holders need an authorisation for short stays in the 30 participating European countries, except for certain Withdrawal Agreement beneficiaries. Your passport must meet two conditions before you can apply.
Who among British passport holders is in scope
The requirement applies to more than just standard British passport holders. British overseas citizens, British protected persons and British subjects also need a valid authorisation for short stays.
A short stay is up to 90 days in any 180-day period across all 30 participating countries, not per country.
Cyprus is different. Time spent there is counted separately and does not reduce your 90-day allowance elsewhere.
Your details are checked against the Schengen Information System (SIS), the Visa Information System (VIS), EURODAC, and Interpol databases, which cover stolen documents and wanted persons.
These systems connect via interoperability components, allowing a single query to reach them all. That is why most decisions are made within minutes.
The checks look for alerts such as refused entry, lost or stolen travel documents, and convictions for serious crimes, including terrorist offences. A match sends your application for manual review.
Your answers also undergo profiling against security, irregular migration and epidemic risk indicators. Any match is reviewed by a person rather than decided automatically.
If you plan to stay longer than 90 days, you need a visa or residence permit under national or EU immigration rules.
Withdrawal Agreement beneficiaries
Some British nationals are exempt. UK nationals covered by the Withdrawal Agreement and their family members do not need authorisation.
They may live in their EU host country and travel to other participating countries by carrying documents that prove their status.
Their status comes from residence documents, not an authorisation, so they have no application file.
Questions about those rights fall outside the border system. The European Union Agency for Fundamental Rights publishes research on how post-Brexit residence rights are applied across member states.
Data on a UK passport
Your passport must be valid for at least three months after your planned departure and be no more than 10 years old.
The 10-year rule often catches travellers out. Older passports with additional months of validity may fail to meet the age requirement despite showing a valid expiry date.
Family members of EU citizens, and of non-EU nationals with free movement rights, are exempt from both conditions.
If you lose your passport in Europe, report it to the local police, contact your consulate for a replacement, and apply again using the new passport details.
Your old authorisation cannot be transferred. It is linked to the lost passport and becomes invalid when the passport is lost.
Get Your Details Right Before You Travel
The information you submit goes into a border management system, not a marketing database. Only authorised authorities can access it, and the file remains linked to your passport.
Before applications open in the last quarter of 2026, learn what the form requires and only share your passport details with someone who clearly explains how they will use them.
When you apply, make sure every detail matches your passport exactly, because even a single error could stop you from boarding your flight.