Regulation (EU) 2018/1240

In forceThis text since 12 Jun 2026law://eu/reg/2018/1240/art_24__para_6@2026-11-11

Contents

6.The following rules shall also apply:

(a)in the notification laid down in Article 38(1) the applicant shall receive information regarding the fact that, when crossing the external border, he or she needs to be able to prove his or her status as family member referred to in point (c) of Article 2(1); such information shall also include a reminder that the family member of a citizen exercising the right of free movement who is in possession of a travel authorisation only has a right to enter if that family member is accompanied by or joining the Union citizen or other third-country national exercising his or her right of free movement;

(b)an appeal as referred to in Article 37(3) shall be lodged in accordance with Directive 2004/38/EC;

(c)the retention period of the application file referred to in Article 54(1) shall be:

(i)the period of validity of the travel authorisation;

(ii)five years from the last decision to refuse, annul or revoke the travel authorisation in accordance with Articles 37, 40 and 41. If the data present in a record, file or alert registered in one of the EU information systems, Europol data, the Interpol SLTD or TDAWN databases, the ETIAS watchlist, or the ETIAS screening rules giving rise to such a decision are deleted before the end of that five-year period, the application file shall be deleted within seven days from the date of the deletion of the data in that record, file or alert. For that purpose, the ETIAS Central System shall regularly and automatically verify whether the conditions for the retention of application files referred to in this point are still fulfilled. Where they are no longer fulfilled, it shall delete the application file in an automated manner.

For the purpose of facilitating a new application after the expiry of the validity period of an ETIAS travel authorisation, the application file may be stored in the ETIAS Central System for an additional period of no more than three years after the end of the validity period of the travel authorisation and only where, following a request for consent, the applicant freely and explicitly consents by means of an electronically signed declaration. Requests for consent shall be presented in a manner which is clearly distinguishable from other matters, in an intelligible and easily accessible form and using clear and plain language, in accordance with Article 7 of Regulation (EU) 2016/679.Consent shall be requested following the provision of information under Article 15(2). The automatically provided information shall remind the applicant of the purpose of the data retention in line with the information referred to in point (o) of Article 71.

Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.

Key facts

Type: Regulation · (EU) 2018/1240
In force: 1 Jan 1001
Adopted: 12 Sept 2018
Applies from: 9 Oct 2018
Applies from: 3 Aug 2021
Text current to: 12 Jun 2026
Made by: Council of the European Union, European Parliament
Official: EUR-Lex 32018R1240 · ELI

Topics

border control data protection EU visa policy external border of the EU foreign national information system personal data Schengen Agreement terrorism travel Area of freedom, security and justice Free movement of persons

History · 1 version

12 Jun 2026Reading

Connections

See on a map

Cited by 3: Regulation (EU) 2026/2280; Commission Implementing Decision (EU) 2026/197019 provisions; this act5 provisions
Cites 2: Regulation (EU) 2016/679 (General Data Protection Regulation); this act2 provisions

Defined terms · 27

Show every defined term

app for mobile devices
means a software application designed to run on mobile devices such as smartphones and tablet computers;
applicant
means any third-country national referred to in Article 2 who has submitted an application for a travel authorisation;
border authority
means the border guard assigned in accordance with national law to carry out border checks as defined in point 11 of Article 2 of Regulation (EU) 2016/399;
CIR
means the common identity repository established by Article 17(1) of Regulation (EU) 2019/817;
consulate
means a Member State’s diplomatic mission or a Member State’s consular post as defined by the Vienna Convention on Consular Relations of 24 April 1963;
designated authority
means an authority designated by a Member State pursuant to Article 50 as responsible for the prevention, detection or investigation of terrorist offences or of other serious criminal offences;
electronically signed
means the confirmation of agreement through the ticking of an appropriate box in the application form or the request for consent;
ESP
means the European search portal established by Article 6(1) of Regulation (EU) 2019/817;
Europol data
means personal data processed by Europol for the purpose referred to in point (a) of Article 18(2) of Regulation (EU) 2016/794;
external borders
means the external borders as defined in point 2 of Article 2 of Regulation (EU) 2016/399;
high epidemic risk
means any disease with epidemic potential as defined by the International Health Regulations of the World Health Organization (WHO) or the European Centre for Disease Prevention and Control (ECDC) and other infectious diseases or contagious parasitic diseases if they are the subject of protection provisions applying to nationals of the Member States;
hit
means the existence of a correspondence established by comparing the personal data recorded in an application file of the ETIAS Central System with the specific risk indicators referred to in Article 33 or with the personal data present in a record, file or alert registered in the ETIAS Central System, in another EU information system or database listed in Article 20(2) (‘EU information systems’), in Europol data or in an Interpol database queried by the ETIAS Central System;
identity data
means the data referred to in points (a), (b) and (c) of Article 17(2);
illegal immigration risk
means the risk of a third-country national not fulfilling the conditions of entry and stay as set out in Article 6 of Regulation (EU) 2016/399;
immigration authority
means the competent authority responsible, in accordance with national law, for one or more of the following:
law enforcement
means the prevention, detection or investigation of terrorist offences or other serious criminal offences;
minor
means a third-country national or a stateless person below the age of 18 years;
other EU information systems
means the Entry/Exit System (‘EES’), established by Regulation (EU) 2017/2226, the Visa Information System (‘VIS’), established by Regulation (EC) No 767/2008 of the European Parliament and of the Council, the Schengen Information System (‘SIS’), established by Regulations (EU) 2018/1860, (EU) 2018/1861 and (EU) 2018/1862 of the European Parliament and of the Council, Eurodac, established by Regulation (EU) No 603/2013 of the European Parliament and of the Council and the European Criminal Record Information System – Third-Country Nationals (‘ECRIS-TCN’), established by Regulation (EU) 2019/816 of the European Parliament and of the Council
overstayer
means a third-country national who does not fulfil, or no longer fulfils the conditions relating to the duration of a short stay on the territory of the Member States;
second line check
means a second line check as defined in point 13 of Article 2 of Regulation (EU) 2016/399;
security risk
means the risk of a threat to public policy, internal security or international relations for any of the Member States;
serious criminal offence
means an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Framework Decision 2002/584/JHA, if it is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years;
short stay
means stays in the territory of the Member States within the meaning of Article 6(1) of Regulation (EU) 2016/399;
terrorist offence
means an offence which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541;
travel authorisation
means a decision issued in accordance with this Regulation which is required for third-country nationals referred to in Article 2(1) of this Regulation to fulfil the entry condition laid down in point (b) of Article 6(1) of Regulation (EU) 2016/399 and which indicates:
travel document
means a passport or other equivalent document entitling the holder to cross the external borders and to which a visa may be affixed;
travel document data
means the data referred to in points (d) and (e) of Article 17(2) and the three letter code of the country issuing the travel document as referred to in point (c) of Article 19(3);

Defined terms · 27

Show every defined term

app for mobile devices
means a software application designed to run on mobile devices such as smartphones and tablet computers;
applicant
means any third-country national referred to in Article 2 who has submitted an application for a travel authorisation;
border authority
means the border guard assigned in accordance with national law to carry out border checks as defined in point 11 of Article 2 of Regulation (EU) 2016/399;
CIR
means the common identity repository established by Article 17(1) of Regulation (EU) 2019/817;
consulate
means a Member State’s diplomatic mission or a Member State’s consular post as defined by the Vienna Convention on Consular Relations of 24 April 1963;
designated authority
means an authority designated by a Member State pursuant to Article 50 as responsible for the prevention, detection or investigation of terrorist offences or of other serious criminal offences;
electronically signed
means the confirmation of agreement through the ticking of an appropriate box in the application form or the request for consent;
ESP
means the European search portal established by Article 6(1) of Regulation (EU) 2019/817;
Europol data
means personal data processed by Europol for the purpose referred to in point (a) of Article 18(2) of Regulation (EU) 2016/794;
external borders
means the external borders as defined in point 2 of Article 2 of Regulation (EU) 2016/399;
high epidemic risk
means any disease with epidemic potential as defined by the International Health Regulations of the World Health Organization (WHO) or the European Centre for Disease Prevention and Control (ECDC) and other infectious diseases or contagious parasitic diseases if they are the subject of protection provisions applying to nationals of the Member States;
hit
means the existence of a correspondence established by comparing the personal data recorded in an application file of the ETIAS Central System with the specific risk indicators referred to in Article 33 or with the personal data present in a record, file or alert registered in the ETIAS Central System, in another EU information system or database listed in Article 20(2) (‘EU information systems’), in Europol data or in an Interpol database queried by the ETIAS Central System;
identity data
means the data referred to in points (a), (b) and (c) of Article 17(2);
illegal immigration risk
means the risk of a third-country national not fulfilling the conditions of entry and stay as set out in Article 6 of Regulation (EU) 2016/399;
immigration authority
means the competent authority responsible, in accordance with national law, for one or more of the following:
law enforcement
means the prevention, detection or investigation of terrorist offences or other serious criminal offences;
minor
means a third-country national or a stateless person below the age of 18 years;
other EU information systems
means the Entry/Exit System (‘EES’), established by Regulation (EU) 2017/2226, the Visa Information System (‘VIS’), established by Regulation (EC) No 767/2008 of the European Parliament and of the Council, the Schengen Information System (‘SIS’), established by Regulations (EU) 2018/1860, (EU) 2018/1861 and (EU) 2018/1862 of the European Parliament and of the Council, Eurodac, established by Regulation (EU) No 603/2013 of the European Parliament and of the Council and the European Criminal Record Information System – Third-Country Nationals (‘ECRIS-TCN’), established by Regulation (EU) 2019/816 of the European Parliament and of the Council
overstayer
means a third-country national who does not fulfil, or no longer fulfils the conditions relating to the duration of a short stay on the territory of the Member States;
second line check
means a second line check as defined in point 13 of Article 2 of Regulation (EU) 2016/399;
security risk
means the risk of a threat to public policy, internal security or international relations for any of the Member States;
serious criminal offence
means an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Framework Decision 2002/584/JHA, if it is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years;
short stay
means stays in the territory of the Member States within the meaning of Article 6(1) of Regulation (EU) 2016/399;
terrorist offence
means an offence which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541;
travel authorisation
means a decision issued in accordance with this Regulation which is required for third-country nationals referred to in Article 2(1) of this Regulation to fulfil the entry condition laid down in point (b) of Article 6(1) of Regulation (EU) 2016/399 and which indicates:
travel document
means a passport or other equivalent document entitling the holder to cross the external borders and to which a visa may be affixed;
travel document data
means the data referred to in points (d) and (e) of Article 17(2) and the three letter code of the country issuing the travel document as referred to in point (c) of Article 19(3);