EU-Switzerland PNR Agreement 2026: What Airlines Must Do with Passenger Data

Key data

Airlines flying between the European Union and Switzerland have had a new compliance obligation since October 2026: to provide Passenger Name Record (PNR) data to security authorities. The international agreement published as OJ:L_202602361 extends to Switzerland the PNR framework that already governs within the EU, creating a formal channel for information exchange for the purposes of preventing and investigating terrorism and serious crimes.

For airline executives and compliance officers, this is not a conceptual novelty—the European PNR model has been in force for years—but it does represent a new operational obligation regarding routes with Switzerland that requires review of processes and contracts.

What does this regulation establish?

The agreement regulates in detail what data must be transferred, for what purpose, under what guarantees and for how long it may be retained. Below are the essential elements:

PNR data that must be transmitted

The agreement establishes that the reservation data that airlines must provide includes, among others:

• Passenger name
• Complete flight itinerary
• Payment method used in the reservation
• Baggage information

This data may be analyzed by authorities to detect risk profiles linked to terrorism or serious crimes.

Permitted purposes

Data protection guarantees

The agreement is not a data transfer without control. It establishes specific data protection guarantees and expressly limits the use of information to the security purposes described. Swiss and European authorities may retain and cross-reference the data for determined periods (the agreement does not publicly specify the exact duration of each period in the summarized text).

Economic and operational impact

The direct impact of this agreement is not an immediate economic penalty, but an operational adaptation cost for affected airlines. The main vectors of impact are:

• IT system adaptation: Airlines must ensure that their reservation systems (GDS, proprietary platforms) are capable of extracting and transmitting PNR data in the format and frequency required by the competent authorities.
• Privacy policy review: Passengers must be informed of the transfer of their data to Swiss and European authorities. The airline's privacy policies and legal notices must be updated.
• Contracts with suppliers: If reservation management is outsourced, contracts with GDS or other suppliers must address this transmission obligation.
• Internal training: Compliance and data protection teams must understand the new framework and procedures for responding to authority requests.

From a strategic perspective, this agreement does not generate fees or tariffs: the impact is regulatory compliance and data management. Airlines that already operate the PNR system for intra-EU routes have a solid starting point; the extension to Switzerland is incremental, not a radical change.

Who does it affect?

• Airlines with direct routes between any EU Member State and Switzerland — main obligation to transmit PNR data.
• Charter and low-cost flight operators with EU-Switzerland routes — same obligation as network airlines.
• Data Protection Officers (DPO) of airlines — must review the impact on records of processing activities and impact assessments (DPIA).
• Reservation system providers (GDS) that manage PNR data for airlines with EU-Switzerland routes.
• Police and judicial authorities of EU Member States and Switzerland — recipients and managers of transferred data.
• Air passengers on EU-Switzerland routes — their reservation data is subject to this transfer and analysis regime.

Practical example

A Spanish airline operates daily flights between Madrid and Zurich. Until this agreement enters into force, its PNR obligations were limited to routes outside the EU or national frameworks. With the new agreement, each reservation on that Madrid-Zurich flight generates PNR data—passenger name, itinerary, payment method, baggage information—that must be transmitted to the competent authorities.

The compliance officer of that airline must verify that the reservation system correctly extracts those fields, that the process of sending to authorities is automated, and that the privacy notice to the passenger explicitly mentions the transfer of data to Swiss and European authorities under this agreement. If the airline uses an external GDS, it must confirm that the contract with that provider covers this transmission obligation.

What should companies do now?

1. Identify affected routes: Map all flights operated between EU Member States and Switzerland to determine the scope of the obligation.
2. Audit PNR extraction systems: Verify that reservation systems (proprietary or GDS) can generate and transmit the required data—name, itinerary, payment method, baggage—in the format required by authorities.
3. Update privacy policies: Include in legal notices and privacy policies the reference to the transfer of PNR data to Swiss and European authorities under this agreement.
4. Review contracts with GDS providers: Ensure that agreements with reservation system providers address this obligation and define clear responsibilities.
5. Update the record of processing activities: The DPO must incorporate this new data flow into the record and assess whether a new Impact Assessment (DPIA) is necessary.
6. Establish a protocol for responding to authorities: Define internally who manages requests for data from police or judicial authorities and in what timeframes.
7. Monitor the entry into force date: The agreement does not specify a concrete application date in the published text; it is essential to follow the EU Official Journal to know when the obligation is activated.

Official source

Consult complete regulation at official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602361