Entry/Exit System
What is the Entry/Exit System?
The Entry/Exit System is an automated information system, that gathers data about non-EU nationals whenever they cross the border of the EU for the purpose of short stay. The processing of data through the EES therefore replaces the requirement to monitor the stay of non-EU nationals via passport stamps.
For the purpose of the EES “non-EU national” is understood as a traveller, who is not a citizen of any EU country, nor of Iceland, Liechtenstein, Norway or Switzerland.
“Short stay” is understood as a stay not exceeding 90 days within any given 180-day period. This period is counted together for all European countries using the EES.
The purpose of the EES is to:
· increase the effectiveness of management of outer borders of the EU
· prevent unauthorized migration
· ease the management of migration flows
· identify travellers who don’t have the right to enter the EU, or who exceeded the maximum duration of authorised stay
· identify travellers who use fake identity, or forged travel documents
· prevent, detect and investigate terrorist offences or other serious criminal offences
The progressive implementation of the EES begun on 25 October 2025, and since 10 April 2026 the system has been fully operational.
More information regarding the EES, including a list of Member States which use the system and their competent authorities can be found on the official website of the European Commission and in the information leaflet.
The official website of the European Commission also includes an online tool where you can check how long you can stay in the EU.
Legal Framework
The establishment, operation and use of the EES are conducted primarily in accordance with Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011.
What kind of information is contained in the EES and who can access it?
The EES gathers and stores the following data:
- information contained in the travel document (e.g. full name, date of birth etc.)
- date and place of every entry and exit
- facial image and fingerprints (the so called “biometric data”)
- information about a potential refusal of entry into the EU
Depending on the specific circumstances, the EES may also gather personal data from the Visa Information System, and/or from the European Travel Information and Authorisation System (ETIAS).
The storing of personal data in the EES is mandatory. Shall the traveller refuse to disclose such information, their entry into the EU will be denied.
The data stored in the EES may be accessed by select authorities within Member States, which use the system for their tasks, such as immigration and visa authorities, or authorities responsible for border control. These authorities use the data for the purpose of identification of the traveller and to assess whether such person should be allowed to enter or stay in the territory of the Member States.
The data in the EES may also be accessed for the purposes of law enforcement by authorities responsible for the prevention, detection and investigation of terrorist offences or other serious criminal offences, as well as by Europol. Under strict conditions the data from the EES may also be disclosed to countries outside the EU or to an international organization for the purposes of return of illegally staying non-EU nationals or for the purposes of law enforcement.
What are the data subject’s rights?
Regulation (EU) 2017/2226 grants to individuals (data subjects) a set of rights derived from article 15-18 of the General Data Processing Regulation (GDPR), through which they may actively exercise their rights and protect their privacy. As such, it is possible to exercise the following rights regarding the processing of personal data in the EES:
· right of access to personal data – the data subject has the right to get a confirmation from the data controller, whether their personal data are processed in the EES, and if so, they have the right to gain access to such data.
· right of rectification or completion of personal data – the data subject has the right to request from the data controller to rectify any incorrect data that are stored about the data subject in the EES or alternatively, to fill in additional information if the data are incomplete.
· right of erasure of personal data – the data subject has the right to request from the data controller to remove any unlawfully stored data related to them from the EES.
· right of restriction of processing of personal data – the data subject has the right to request from the data controller to restrict the processing of their personal data in the EES, for example while the data controller verifies the accuracy and completeness of the personal data contested by the data subject.
The aforementioned rights shall be exercised in accordance with the national law of the respective Member State in which the request is submitted. As such, the specific procedure for handling EES-related requests may vary depending on the Member State concerned. An overview of the Member State authorities responsible for the processing of personal data in the EES can be found on the official website of the European Commission.
How do I exercise my rights in the Czech Republic?
The authority which fulfils the role of data controller responsible for the handling of EES‑related requests in the Czech Republic is the Police of the Czech Republic.
Contact details:
Policejní prezidium České republiky
P. O. Box 62/K-SOU
Strojnická 27
170 89 Praha 7
Czech Republic
Data box ID: gs9ai55
podatelna@policie.gov.cz
EES-related requests can be submitted to the Police of the Czech Republic via the contact details listed above, or alternatively, they may also be filed in person at any office of the Police of the Czech Republic during work hours.
Any EES‑related request must include basic identification of the applicant (the data subject) necessary for the successful handling of the request. This includes the full name of the data subject, their date of birth and address of permanent residence or other postal address to which a response can be sent.
In case the data subject is legally represented by a different person, the request must also include a copy of a document proving legal authorization of the representative to act on behalf of the data subject – typically a special attorney’s power to file data protection related requests on behalf of the data subject.
The Police of the Czech Republic is required to respond within 45 days of receipt to any request concerning personal data entered into the EES by the Czech Republic.
In cases where the request relates to the rectification, completion, or erasure of personal data, which were entered into the EES by a different Member state than the Czech Republic, the Police of the Czech Republic reviews within 30 days of receipt, whether or not it is possible to fully resolve the request without consulting the respective Member State. If a consultation with the respective Member state is necessary, the Police contacts the competent authorities of the concerned Member State within 7 days. In such cases the final response to the request may be sent either by the Police of the Czech Republic, or by the authorities of the consulted Member State.
The handling of EES‑related requests is free of charge.
The Police of the Czech Republic may refuse to act on the request if it is manifestly unfounded or excessive, in particular due to its repetitive character.
More information about the processing of personal data by the Czech Republic, including information about the way data protection related requests are handled, can be found on the official webpage of the Police of the Czech Republic.
!! It is important to note that requests sent to the Police of the Czech Republic (as the data controller responsible for the processing of data in the EES by the Czech Republic) must include a correct and up-to-date postal address to which the response can be sent. The Police of the Czech Republic sends official responses to data protection related requests exclusively in writing via the postal service in order to minimize the risk of the response being accessed by an unauthorized person. In case the postal address stated in your request is incorrect, the response will not be successfully delivered. !!
Remedies
Every person has the right to bring an action before the competent authorities or courts of the Member State which refused to grant them the right of access to, or the right of rectification, completion or erasure of data related to them. The right to bring such an action shall also apply in cases where the request for access, rectification, completion or erasure was not responded to within legal deadlines or was never dealt with by the data controller.
When should I contact the Office for Personal Data Protection?
The Office for Personal Data Protection is competent to verify the legality of the processing of personal data within the EES when there is a suspicion of unlawful conduct on the side of the data controller (the Police of the Czech Republic) or in cases where the data controller didn’t provide the data subject with a satisfactory response to their request. We therefore recommend contacting the Office for Personal Data Protection after one of the aforementioned situations arises.
If the data subject contacts the Office for Personal Data Protection first, the request will be forwarded to the Police of the Czech Republic. This approach, however, might lead to delay in the handling of the request.
When submitting a complaint to the Office for Personal Data Protection it is recommended to use the official contact form: Complaint regarding the processing of personal data in the Entry/Exit System