EU-Norway PNR Agreement 2026: obligations for airlines with routes to Norway

Key data

Airlines flying between the European Union and Norway have a new data transfer obligation in force from June 4, 2026. The EU Council formally approved, through Decision (EU) 2026/1916, the Agreement between the EU and the Kingdom of Norway on the transfer of passenger name record (PNR) data for the purposes of prevention, detection, investigation and prosecution of terrorism offences and serious crimes.

This agreement is not a conceptual novelty: it follows the model already applied with the United States, Canada and Australia. What changes now is that Norway — a country integrated into the Schengen area — is formally incorporated into this EU security cooperation framework.

What does this regulation establish?

The agreement regulates what data can be transferred, for what purpose, who receives it and under what guarantees. The essential points are:

The use limitations are a central element of the agreement: PNR data can only be used for the expressly provided purposes (terrorism and serious crimes), not for any police or administrative investigation. This is also relevant from the perspective of airlines' responsibility as personal data transmitters.

Economic and operational impact

For airlines, this agreement translates into concrete operational obligations that may require technical and process adaptations:

• Data transmission systems: Airlines must be able to send PNR data to passenger information units in the formats and timeframes established by the agreement. If they already operate routes with the USA, Canada or Australia under similar PNR agreements, the technical infrastructure can be reusable, which reduces adaptation costs.
• Privacy policy review: Passengers must be informed of the transfer of their data to Norwegian authorities. This may involve updating legal notices, transport conditions and booking forms.
• Coordination with authorities: Airlines will need to establish or update communication channels with passenger information units in both the EU and Norway.
• Data protection compliance: The transmission of PNR data must be correctly framed within the GDPR framework and the specific guarantees of the agreement, which may require updating processing activity records and impact assessments.

The direct economic impact is not quantified in the regulation, but airlines that already comply with equivalent PNR agreements will have lower adaptation costs than those operating routes to Norway without prior experience with this type of obligation.

Who is affected?

• Airlines with routes between any EU Member State and Norway: They are the main obligated parties. They must transmit the PNR data of their passengers to passenger information units.
• Charter flight operators and low-cost airlines that operate EU-Norway routes, not just major flag carriers.
• Passengers on EU-Norway flights: Their data (name, itinerary, baggage, payment method) will be transmitted to the competent authorities.
• European and Norwegian security authorities: They will receive and process PNR data within the framework of guarantees established.
• Compliance and data protection departments of airlines: They will need to review and update their internal procedures.

Practical example

A Spanish airline operates regular flights between Madrid and Oslo. Until now, it was not subject to any formal PNR agreement with Norway. From June 4, 2026, this company must:

1. Transmit to the competent passenger information unit the PNR data of each passenger on each Madrid-Oslo and Oslo-Madrid flight: full name, itinerary (origin, destination, stops), information on checked baggage and payment method used in the booking.
2. Update its privacy policy and passenger notices to reflect that its data is transferred to Norwegian authorities under this agreement.
3. Verify that its reservation management systems (PNR) can generate and send the data in the format required by the receiving authorities.

If this same airline already operates flights to the USA or Canada under similar PNR agreements, much of the technical infrastructure and compliance processes will already be in place, which significantly facilitates adaptation to the new agreement with Norway.

What should companies do now?

1. Identify if you operate EU-Norway routes: If your airline has any flight between an EU Member State and Norway, you are affected. The obligation applies from June 4, 2026.
2. Review PNR data transmission infrastructure: Check if your systems can send the required data (name, itinerary, baggage, payment method) to passenger information units. If you already comply with PNR agreements with the USA, Canada or Australia, assess whether the same system is adaptable.
3. Update data protection documentation: Review and update passenger privacy notices, processing activity records and, if applicable, data protection impact assessments (DPIA) to include this new transfer.
4. Establish channels with passenger information units: Contact the competent authorities in the EU and Norway to confirm the operational procedures for data transmission.
5. Train compliance and operations teams: Ensure that those responsible for compliance, data protection and operations are aware of the new obligations and applicable deadlines.

Official source

View full regulation on official source

Notice: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202601916