Regulation (EC) No 767/2008 (VIS Regulation)

In force

This text since 12 Jun 2026law://eu/reg/2008/767/art_32@2026-11-15

Contents

Article 32Data security#

1.The Member State responsible shall ensure the security of the data before and during transmission to the national interface. Each Member State shall ensure the security of the data which it receives from the VIS.

2.Each Member State shall, in relation to its national system, adopt the necessary measures, including a security plan, in order to:

(a)physically protect data, including by making contingency plans for the protection of critical infrastructure;

(b)deny unauthorised persons access to national installations in which the Member State carries out operations in accordance with the purposes of the VIS (checks at entrance to the installation);

(c)prevent the unauthorised reading, copying, modification or removal of data media (data media control);

(d)prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored personal data (storage control);

(e)prevent the unauthorised processing of data in the VIS and any unauthorised modification or deletion of data processed in the VIS (control of data entry);

(f)ensure that persons authorised to access the VIS have access only to the data covered by their access authorisation, by means of individual and unique user identities and confidential access modes only (data access control);

(g)ensure that all authorities with a right of access to the VIS create profiles describing the functions and responsibilities of persons who are authorised to access, enter, update, delete and search the data and make these profiles available to the National Supervisory Authorities referred to in Article 41 without delay at their request (personnel profiles);

(h)ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment (communication control);

(i)ensure that it is possible to verify and establish what data have been processed in the VIS, when, by whom and for what purpose (control of data recording);

(j)prevent the unauthorised reading, copying, modification or deletion of personal data during the transmission of personal data to or from the VIS or during the transport of data media, in particular by means of appropriate encryption techniques (transport control);

(k)monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to internal monitoring to ensure compliance with this Regulation (self-auditing).

3.The Management Authority shall take the necessary measures in order to achieve the objectives set out in paragraph 2 as regards the operation of the VIS, including the adoption of a security plan.

Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.

Key facts

Type: Regulation · (EC) No 767/2008
In force: 1 Jan 1001
Adopted: 9 Jul 2008
Applies from: 2 Sept 2008
Text current to: 12 Jun 2026
Made by: Council of the European Union, European Parliament
Official: EUR-Lex 32008R0767 · ELI

Topics

data protection disclosure of information EU visa policy exchange of information information system Free movement of persons

History · 1 version

12 Jun 2026Reading

Connections

See on a map

Cited by 7: Regulation (EU) 2018/1240; Regulation (EU) 2019/8183 provisions; this act; Regulation (EU) 2019/8174 provisions; Regulation (EU) 2019/8166 provisions; Regulation (EU) 2017/22264 provisions; Commission Delegated Regulation (EU) 2021/22236 provisions

Defined terms · 13

Show every defined term

alphanumeric data
means data represented by letters, digits, special characters, spaces and punctuation marks;
applicant
means any person subject to the visa requirement pursuant to Council Regulation (EC) No 539/2001 of 15 March 2001 listing the third countries whose nationals must be in possession of visas when crossing the external borders and those whose nationals are exempt from that requirement, who has lodged an application for a visa;
application form
means the uniform application form for visas in Annex 16 to the Common Consular Instructions;
fingerprint data
means the data relating to the five fingerprints of the index, middle finger, ring finger, little finger and the thumb from the right hand and, where present, from the left hand.
group members
means applicants who are obliged for legal reasons to enter and leave the territory of the Member States together;
identification
means the process of determining a person's identity through a database search against multiple sets of data (one-to-many check);
identity data
means the data referred to in Article 9(4)(a) and (aa);
Member State responsible
means the Member State which has entered the data in the VIS;
travel document
means a passport or other equivalent document entitling the holder to cross the external borders and to which a visa may be affixed;
verification
means the process of comparison of sets of data to establish the validity of a claimed identity (one-to-one check);
visa
means:
visa authorities
means the authorities which in each Member State are responsible for examining and for taking decisions on visa applications or for decisions whether to annul, revoke or extend visas, including the central visa authorities and the authorities responsible for issuing visas at the border in accordance with Council Regulation (EC) No 415/2003 of 27 February 2003 on the issue of visas at the border, including the issue of such visas to seamen in transit;
visa sticker
means the uniform format for visas as defined by Regulation (EC) No 1683/95;