The short answer
Your Entry/Exit System file holds your name, passport data, a facial image, fingerprints if you are 12 or over, and the date, time and place of every entry, exit and refusal of entry. Article 34 of Regulation (EU) 2017/2226 keeps that record for three years after your last exit, and for five years where no exit was recorded after your authorised stay expired.
Entry exit system privacy questions rarely stop at the fingerprint reader. What frequent travellers actually want to know is which fields exist, which retention clock applies to them, who is allowed to run a search, and what to do when the file says something untrue. The legal framework is unusually explicit on all four, so we quote it rather than speculate. For the wider picture, start with our guide to the EU's biometric border system.
One date frames everything below. According to the European Commission, EES became fully operational on 10 April 2026 at all external border crossing points of the countries using it, after a phased rollout that began on 12 October 2025. As of September 2026 the law is settled; the practice around it is still bedding in.
Exactly what goes into your EES file
The European Commission describes the system in one sentence: it "registers the person's name, travel document data, biometric data (fingerprints and captured facial images) and the date and place of entry and exit."
The regulation is more granular. Article 16 of Regulation (EU) 2017/2226 lists surname, given names, date of birth, nationality and sex; the type, number and expiry date of the travel document and the issuing country; the facial image; the date and time of entry and the border crossing point; visa details where relevant; and a flag where the record indicates an overstay. Article 17 adds, for visa-exempt travellers, four fingerprints taken from the right hand where possible, or the left where not. Refusals of entry are recorded with their grounds.
Note what is absent. There is no field for your address in Europe, your employer, your reason for travel or your finances, and no record of what the officer asked you. The file is a border-crossing ledger, not a profile.
For the mechanics of how those fields get captured at the booth or self-service station, we walk through enrolment step by step in our piece on how the Entry/Exit System actually works at the border.
How long the EU keeps it, and the overstay exception
This is the detail most coverage blurs, so here are the two clocks, separately.
The standard clock. Article 34(1) provides that each entry/exit record or refusal-of-entry record is stored "for three years following the date of the exit record or of the refusal of entry record, as applicable." Article 34(2) treats the individual file itself — the identity and biometric layer — slightly differently: it is kept for "three years and one day following the date of the last exit record," where you have not re-entered within those three years. In practice, every clean trip restarts the clock from your exit.
The overstay clock. Article 34(3) is the one to understand precisely. "If there is no exit record following the date of expiry of the period of authorised stay, the data shall be stored for a period of five years following the date of expiry of the period of authorised stay." Note the trigger: not simply a missing exit scan, but a missing exit record combined with an authorised stay that has run out. The five years count from the day your permission expired, not from your last entry.
The same paragraph adds a mechanism worth knowing: "The EES shall automatically inform the Member States three months in advance of the scheduled erasure of data on overstayers in order to enable them to adopt the appropriate measures." An open overstay flag does not simply age out quietly.
One narrower category exists: Article 34(4) caps retention at one year after exit for the travellers described in Article 2(1)(b), family members of EU citizens who hold no residence card or permit.
Article 34(5) does the reassuring part: on expiry of those periods, data "shall automatically be erased from the EES Central System and from the CIR." Deletion is a scheduled system function, not something anyone has to remember to do. Why a wrongly open record matters so much in practice is the subject of our companion piece on why overstaying just got much harder.
Children, fingerprints and facial images
These are two different rules, regularly reported as one.
- Fingerprints. Article 17 states plainly that "children under the age of 12 shall be exempt from the requirement to give fingerprints." From a child's twelfth birthday, fingerprints are collected like anyone else's.
- Facial images. Article 15 contains no equivalent age exemption. It requires that the facial image "shall be taken live," with electronic extraction from the passport chip permitted only in exceptional cases where a live capture cannot meet the quality standard. Infants included.
So a family of four crossing with two under-12s produces four facial images and two sets of fingerprints. Article 17 also exempts people physically unable to give fingerprints; where that is temporary, the system flags it and asks again at exit or next entry.
Being exempt from fingerprinting is not the same as being outside the system. Some travellers are out of scope altogether, which we cover in our breakdown of who is exempt from EES and ETIAS.
Who can query your record
Access is layered, and the layers have different tests.
Border, visa and immigration authorities use EES for its core purpose: verifying identity, calculating remaining authorised stay, and detecting overstays. That is the overwhelming majority of queries.
Carriers get the thinnest slice. Under Article 13(3), airlines, ferry and rail operators must check before boarding whether passengers holding a short-stay visa issued for one or two entries have already used the number of entries their visa authorises, through an interface that returns an OK or not-OK answer rather than the contents of your file.
Designated law-enforcement authorities can reach EES data, but only on conditions. Article 32(1) requires all of the following to be met: that access "is necessary for the purpose of the prevention, detection or investigation of a terrorist offence or another serious criminal offence"; that it is "necessary and proportionate in a specific case"; and that "evidence or reasonable grounds exist to consider that the consultation of the EES data will contribute to" that investigation. Where the aim is to identify an unknown suspect, perpetrator or victim, Article 32(2) adds a prior search in national databases, and for fingerprint searches a prior search in other Member States' fingerprint systems — waived only where there are reasonable grounds to think it would not help, or in urgent cases to prevent imminent danger.
Europol has its own gate. Article 33 mirrors the necessity and proportionality tests and then adds that EES may be used to identify an unknown person only where consultation of the databases already technically and legally accessible to Europol has failed. Article 33(5) requires that Europol "shall only process information obtained from a consultation of EES data subject to the authorisation of the Member State of origin."
Read that as neither open access nor no access. It is conditional and case-by-case.
Does the data leave the EU, and how EES connects to the other databases
On transfers, Article 41 opens with a flat prohibition: "Data stored in the EES shall not be transferred or made available to any third country, to any international organisation or to any private entity." The derogations are narrow and purpose-bound — individual cases for identity verification and return, where the destination country has an adequacy decision or equivalent safeguards, the recipient commits to using the data only for the stated purpose, and a return decision has been issued. For data obtained through the law-enforcement route, transfer is barred except in cases of exceptional urgency involving a terrorist threat or imminent danger to life, with reciprocity and a documented record.
Internally, EES does not sit alone. Regulation (EU) 2019/817 built four interoperability components across the EU's border and visa systems: a European Search Portal, a shared biometric matching service, a Common Identity Repository and a multiple-identity detector. The Common Identity Repository holds the identity layer of files from EES, the Visa Information System, Eurodac, ETIAS and the criminal-records system for third-country nationals — which is why Article 34 speaks of storage "in the CIR and in the EES Central System" rather than in EES alone.
Worth separating: your EES record is a crossing history. A visa record sits in the Visa Information System, and a pre-travel authorisation record would sit in ETIAS, which as of September 2026 has still not launched — the EU dropped its late-2026 target and has not published a replacement date. We track that timeline in the honest 2026 status of ETIAS.
When the record is wrong: your rights and how to use them
This matters more than surveillance in the abstract: a missing exit scan can leave you looking like an overstayer when you were home in time.
Article 52 of the regulation gives you rights of access, correction, completion and erasure, and it sets real deadlines:
- Address the request to a Member State. You may write to the competent authority of any country using EES; official EU guidance is to prefer one you actually travelled to, and the EU publishes national contact points for data protection matters on its EES pages. There is no single EU inbox.
- Say which right you are exercising — access to your file, correction of inaccurate or incomplete data, or erasure of data recorded unlawfully.
- Expect a reply within 45 days. If the country you wrote to is not the one that made the record, it has 7 days to contact the responsible Member State, which then has 30 days to check.
- Get it in writing. Where data are confirmed to be "factually inaccurate, incomplete or have been recorded unlawfully," the responsible Member State must correct or erase them without delay and confirm in writing. If it disagrees, it must issue a written administrative decision explaining why, together with information on your remedies.
- Escalate if you must. Those remedies include a complaint to a national data protection authority. Chapter VII splits supervision between national supervisory authorities, which monitor Member States' processing, and the European Data Protection Supervisor on the EU agency side, where eu-LISA runs the central system.
The uncomfortable part: nothing in the regulation suspends your day count while a dispute is pending. The flag keeps its effect until it is corrected. That is why we treat this as a pre-travel task, not a post-refusal one.
The paper trail worth keeping
Because the burden of showing you left falls on you, keep the evidence before you need it. What travellers report being accepted is ordinary documentation:
- Boarding passes and e-tickets for every departure from the area, including ferries and trains
- Card or bank transactions dated outside the Schengen area on the days after a disputed exit
- Accommodation bookings and receipts covering the same dates
- Any passport stamps you do get from non-Schengen countries on arrival
- A screenshot of your own day count each time you leave
That last one is cheap insurance. The EU runs an official tool on its EES pages that tells a traveller whether entry is currently allowed, OK or not OK, and how many days of authorised stay remain. One caveat is published with it: the calculation does not reflect time in the area that began before 10 April 2026. If you were in Europe across that boundary, the tool's number is not the whole story. The underlying arithmetic itself has not changed, and we still cover it in the Schengen 90/180 rule.
What this means if you live between countries
Three practical consequences for anyone cycling through Europe rather than visiting it. Your record is anchored to the passport as well as to you, so a new passport generally means a fresh enrolment. Your standard clock restarts from each exit, so a genuinely active traveller's file never really empties even though each record expires on its own three-year timer. And one failed exit scan, if it is still uncorrected when your authorised stay runs out, now carries a five-year tail rather than a shrug.
None of that argues against short stays. It argues for either counting properly or moving to a status that takes you out of the 90/180 count entirely, which is the calculation behind most of the residence and nomad visa routes we compare.
Frequently asked questions
Can I ask for my EES data to be deleted on request? No. Article 52 gives a right to erasure of data "recorded unlawfully" — not a general opt-out. Lawfully recorded crossings stay until the retention period in Article 34 expires, at which point deletion is automatic.
Can I refuse to give biometrics? Not and still enter. For travellers in scope there is no non-biometric lane; refusal results in refusal of entry, which is itself a recorded event.
Will my home country be told about an overstay flag? Not as a matter of routine. Article 41 prohibits transfers of EES data to third countries, international organisations and private entities, with narrow derogations tied mainly to return procedures and, separately, to exceptional urgency in terrorism or threat-to-life cases.
How quickly should I act on a missing exit record? Before your next trip. With a 45-day reply window and a possible 30-day verification on top, a correction started the week before a flight will not be finished in time.
The bottom line
The EU Entry/Exit System is, on paper, one of the better-documented biometric databases a traveller will ever be entered into. The fields are enumerated, the retention periods are numbered, law-enforcement access has cumulative conditions, export is prohibited by default, and there is a deadlined correction procedure with named supervisors.
The real risk is not that the file exists. It is that the file is wrong and you find out at a border. So: screenshot your remaining days every time you leave, keep the boarding passes for a year, and if an exit ever looks unrecorded, write to a Member State's data protection contact while you are still at home. The framework works — but only if you use it before the clock does.
