Status: Checked against official sources on 18 October 2026
FREQUENT FLYER GLOSSARY
What is the GDPR in travel bookings?
The General Data Protection Regulation (GDPR) is the European Union's data protection law, Regulation (EU) 2016/679, which sets how airlines, hotels and travel sellers may handle travellers' personal data — including the passenger name record (PNR) behind a booking — and gives people rights over the data held about them. [1] [2] It entered into force on 24 May 2016 and has applied since 25 May 2018. [2]
Facts checked: 18 October 2026
Key takeaways
- The GDPR is an EU regulation of 27 April 2016, published as Regulation (EU) 2016/679 with the note “Text with EEA relevance”. [1]
- The protection it gives applies to natural persons whatever their nationality or place of residence, and it can reach a company based outside the Union when it offers goods or services to people in the Union. [1]
- Most booking data sits in the passenger name record, which British Airways says can carry passport details, fare and ticket information, frequent-flyer numbers and special service requests. [6]
- The United Kingdom runs a separate regime, the UK GDPR together with the Data Protection Act 2018. [3]
What the GDPR covers in a travel booking
The regulation's full title is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and it was published in the Official Journal of 4 May 2016 at pages 1–88. [1] The European Commission describes data protection as a fundamental right under EU law and lists the GDPR alongside the Law Enforcement Directive and the Data Protection Regulation for EU institutions, bodies, offices and agencies as the Union's data protection legislation. [2]
What counts as personal data. Personal data is any information concerning an identified or identifiable natural person, and information that does not relate to an identifiable person — anonymous information — falls outside the regulation. [1] The protection applies to natural persons whatever their nationality or place of residence. [1] The regulation does not apply to the personal data of deceased persons, although Member States may provide their own rules for that data. [1]
Who it reaches. A company that is not established in the Union is still caught where its processing relates to offering goods or services to people in the Union, whether or not a payment is involved, or to monitoring their behaviour inside the Union. [1] In practice the booking record that carries this data is the passenger name record: British Airways says a PNR may include name, contact details, passport information, travel dates and routes, ticket and fare information, seat and meal preferences, payment details where held in the booking, frequent-flyer number, baggage information and special service requests such as assistance needs. [6]
What can I ask an airline or hotel to do with my data?
See it. Information about processing should be easily accessible and easy to understand, and a person should be able to obtain confirmation and communication of the personal data being processed about them, together with the purposes of the processing. [1]
Correct it. Every reasonable step should be taken to ensure that inaccurate personal data is rectified or deleted. [1] In air travel this overlaps with name correction, where the fix has to reach both the reservation and the ticket.
Limit how long it is kept. So that data is not held longer than necessary, controllers should set time limits for erasure or for a periodic review. [1]
Control consent. Silence, pre-ticked boxes or inactivity should not constitute consent, and where processing rests on consent, a person must not be unable to refuse or withdraw it without detriment. [1]
Transfer safeguards. Booking.com's traveller privacy notice, updated August 2026, says that where data of a traveller in the European Economic Area goes to service providers in countries the European Commission does not consider adequate, it puts contractual, organisational and technical measures in place using Standard Contractual Clauses, and that transfers within its group are covered by Binding Corporate Rules. [5]
The UK regime. The United Kingdom is governed by the UK GDPR and the Data Protection Act 2018. [3] GOV.UK lists the rights under that legislation, with some exceptions, as being informed about how data is used, access, correction, erasure, restriction of processing, portability and objection, plus rights over automated decision-making and profiling. [3]
How long is booking data kept?
Retention periods are set by the company or authority holding the record, not by a single figure in the regulation. [1] The examples below are the operators' own statements and apply only to them.
| Record | Held by | Retention stated |
|---|---|---|
| Passenger name record | British Airways | Seven years from the date of travel, then deleted or anonymised unless needed longer for legal, regulatory, tax, accounting, safety, security, fraud-prevention, claims or dispute-resolution reasons [6] |
| PNR received by authorities | UK and EU authorities | Up to five years, with identifying details masked after an initial period; each country sets its own periods [6] |
| Customer service call recordings | Booking.com | 30 days by default, then automatic deletion unless needed for fraud investigation or legal purposes [5] |
| CCTV footage | British Airways | Normally 30 days before deletion unless needed for a specific incident, investigation or legal reason [6] |
Once a PNR has been transmitted to a government authority, that authority is responsible for how it uses, retains and shares the data under its own laws, and a passenger may need to contact it directly rather than the airline. [6]
What a data request cannot change
- The right is not absolute. The regulation states that the right to the protection of personal data is not an absolute right and must be considered against its function in society and balanced with other fundamental rights, in accordance with the principle of proportionality. [1]
- It is not a contract term. British Airways states that its Privacy Promise and Privacy Policy are not part of any contract between the airline and the passenger, and that nothing in them affects the passenger's legal rights. [6]
- It does not rewrite the fare rule. EU data protection legislation governs the protection of personal data [2], so a request made under it does not by itself alter the fare rule attached to a ticket, cancel a booking, reverse a no-show charge or replace the contract of carriage, which stand apart from the privacy notice an airline publishes. [6]
- It stops at the border of the regime. The UK applies the UK GDPR and the Data Protection Act 2018 rather than the EU regulation, so the two systems are described by their own rules and remedies. [3]
- Some data is outside it. Anonymous information and the personal data of deceased persons are outside the regulation's scope, subject to any national rules Member States make for the deceased. [1]
Frequently asked questions
Does the GDPR apply to an airline based outside the EU?
It can. The regulation covers a controller not established in the Union where processing relates to offering goods or services to people in the Union, or to monitoring their behaviour there, and the protection applies whatever a person's nationality or place of residence. [1]
Can I ask for my booking data to be erased?
Erasure appears among the rights in the UK regime, subject to some exceptions. [3] Under the EU regulation, controllers should set time limits for erasure or periodic review so that data is not kept longer than necessary [1], and British Airways, for example, keeps a PNR for seven years from the travel date unless a listed reason requires longer. [6]
Does a data request get me a refund or waive a no-show fee?
No. EU data protection legislation concerns the protection of personal data [2], and British Airways states that its privacy policy is not part of any contract with passengers and does not affect their legal rights. [6] Correcting or removing data leaves the fare rule and the contract of carriage where they were.
What information sits in the PNR behind my booking?
British Airways says a PNR may hold your name, contact details, passport information, travel dates and routes, ticket and fare information, seat and meal preferences, payment details where held, frequent-flyer number, baggage information and special service requests. [6] See passenger name record.
How do I make a request?
British Airways directs passengers to its Privacy Centre to exercise rights over the PNR data it holds, while a PNR held by a government authority has to be taken up with that authority. [6] Booking.com's notice likewise sets out its own route for rights requests. [5]
Sources
Sources accessed on 18 October 2026. Only British Airways and Booking.com are used as company examples; other airlines, hotel groups and online travel agencies publish their own retention periods and their own request routes and are not covered here.
- Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex, checked 18 October 2026
- European Commission, Data protection, checked 18 October 2026
- GOV.UK, Data protection: the UK's data protection legislation, checked 18 October 2026
- Booking.com, Privacy Notice for Travelers, checked 18 October 2026
- British Airways, Privacy Policy, checked 18 October 2026