In 2026, the retention of Passenger Name Record (PNR) data is strictly governed by international security agreements and data privacy laws like the GDPR. Most commercial airlines keep "active" PNR data for about 6 months after the completion of the travel for customer service and billing purposes. However, for security and law enforcement, this data is often archived for much longer. Under the 2026 EU-US PNR Agreement, data is moved to a "dormant" database after 6 months, where identifying details (like names and contact info) are masked or "depersonalized." This masked data can be held for up to 5 years to help authorities track patterns related to terrorism or serious transnational crime. After the 5-year mark, the record is typically deleted or fully anonymized for statistical use only. Travelers can request a copy of their PNR data from the airline under modern "Right of Access" privacy regulations.