Key data
| Regulation | Council Decision (EU) 2026/2360, of October 1, 2026 |
|---|---|
| Publication | October 26, 2026 |
| Entry into force | October 1, 2026 |
| Affected parties | Airlines with routes between the EU and Switzerland, and passengers flying between both territories |
| Category | European Regulation |
| Year | 2026 |
| Official reference | OJ:L_202602360 |
Airlines flying between the European Union and Switzerland have a new operational obligation in force since October 1, 2026: to transmit passenger name record (PNR) data to the competent Swiss authorities. This is established by the Council Decision (EU) 2026/2360, published in the EU Official Journal on October 26, 2026.
This agreement is not a conceptual novelty: the EU already has similar frameworks with the United States and Canada. What is changing now is that Switzerland is joining that system, which requires air carriers to review and adapt their data management and transmission processes on these specific routes.
What does this regulation establish?
The agreement enables the competent Swiss authorities to use PNR data of passengers flying on EU-Switzerland routes for the following purposes:
- Prevention of terrorism offences and serious crimes
- Detection of activities related to such offences
- Investigation of specific cases
- Prosecution of those responsible
The PNR data that airlines must transmit includes information such as:
- Passenger name
- Flight itinerary
- Baggage information
- Payment method used
- Traveller contact data
The agreement incorporates data protection safeguards and establishes limitations on use of the information, following the model already consolidated with the USA and Canada. This means that data cannot be used for purposes other than those expressly authorized.
Furthermore, the agreement strengthens cross-border judicial and police cooperation between EU Member States and Switzerland, which has direct implications for the security authorities of both territories.
Economic and operational impact
For airlines, the main impact is operational and technological. The obligation to transmit PNR data to Switzerland involves:
- Reviewing and updating passenger data management systems (DCS/PSS) to include Switzerland as a transmission destination
- Adapting data flows to the designated Swiss authorities under the agreement
- Ensuring that transmitted data complies with the data protection safeguards established in the agreement
- Updating personal data processing records in accordance with the GDPR and the international agreement
Airlines already operating under PNR agreements with the USA and Canada have an advantage: their systems are already prepared for this type of transmission. Adaptation to Switzerland will, in many cases, be an extension of existing infrastructure. For companies that did not have such previous obligations, the adaptation effort will be greater.
The agreement also has implications for the compliance and data protection departments of airlines, which will need to update their internal policies and the information provided to passengers about the processing of their data.
Who does it affect?
- Airlines with direct EU-Switzerland routes: direct obligation to transmit PNR data to the designated Swiss authorities
- Airlines with connections including Switzerland: must review whether their routes with stopovers generate obligations under the agreement
- Operations and technology departments of airlines: responsible for adapting data transmission systems
- Data protection departments (DPO) of airlines: must update processing records and privacy policies
- Legal and compliance departments: must verify alignment with the GDPR and the international agreement
- Passengers flying between the EU and Switzerland: their personal data (name, itinerary, baggage, payment, contact) will be shared with Swiss authorities
Practical example
A Spanish airline operating regular flights between Madrid and Zurich must, from October 1, 2026, transmit to the designated Swiss authorities the PNR data of each passenger on those routes. This includes the traveller's full name, their itinerary (origin, destination, stopovers), information about their checked baggage, the payment method used to purchase the ticket, and their contact details.
If this airline was already transmitting PNR data to the USA or Canada under existing agreements, its technical system is already prepared for this type of flow. The adaptation will consist of adding Switzerland as a new recipient in its transmission platform and updating data protection documentation. If, on the other hand, it is an airline that operates exclusively European routes and had not previously had this obligation, it will need to implement the system from scratch, with the corresponding technological and legal cost.
What should companies do now?
- Identify if they operate EU-Switzerland routes: verify which flights are affected by the agreement and what volume of passengers it impacts.
- Review PNR data transmission systems: check whether current technological infrastructure allows adding Switzerland as a transmission destination or if it requires additional development.
- Contact the designated Swiss authorities: identify the PNR data receiving body in Switzerland and establish the transmission channel in accordance with the agreement.
- Update the record of processing activities: the DPO must reflect this new international transfer of personal data in the data protection documentation.
- Review passenger information: update privacy notices and transport conditions to inform travellers about the transmission of their data to Switzerland.
- Align with legal teams: verify that data processing complies with the safeguards and use limitations established in the agreement, especially the restriction of use exclusively for prevention, detection, investigation and prosecution of terrorism and serious crimes.
Frequently asked questions
What specific data must airlines transmit under the EU-Switzerland PNR agreement?
Airlines must transmit passenger name record (PNR) data, which includes: passenger name, flight itinerary, baggage information, payment method used, and traveller contact data. This data is transmitted to the designated Swiss authorities under the agreement.
When did the EU-Switzerland PNR agreement enter into force?
The agreement entered into force on October 1, 2026, although the Council Decision formally approving it was published in the EU Official Journal on October 26, 2026. Affected airlines must comply from that date.
What can Swiss authorities use passenger PNR data for?
The agreement limits the use of PNR data to four exclusive purposes: prevention, detection, investigation and prosecution of terrorism offences and serious crimes. The agreement establishes data protection safeguards and use limitations that prohibit using it for other purposes.
Which airlines are obliged to transmit PNR data to Switzerland?
All airlines operating routes between the European Union and Switzerland. The agreement affects air carriers covering these routes, regardless of their nationality or country of registration, as long as they operate flights between both territories.
Is this the EU's first PNR agreement or do similar ones already exist?
It is not the first. The EU already has PNR agreements in force with the United States and Canada. The agreement with Switzerland follows the same model, which facilitates adaptation for airlines already complying with existing PNR frameworks on those routes.
Official source
View complete regulation at official source
Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602360
