Regulation (EU) 2019/818

In force

This text since 12 Jun 2026law://eu/reg/2019/818/art_42__para_3@2026-11-12

Contents

3.In particular, eu-LISA shall adopt the necessary measures, including a security plan, a business continuity plan and a disaster recovery plan, in order to:

(a)physically protect data, including by making contingency plans for the protection of critical infrastructure;

(b)deny unauthorised persons access to data-processing equipment and installations;

(c)prevent the unauthorised reading, copying, modification or removal of data media;

(d)prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of recorded personal data;

(e)prevent the unauthorised processing of data and any unauthorised copying, modification or deletion of data;

(f)prevent the use of automated data-processing systems by unauthorised persons using data communication equipment;

(g)ensure that persons authorised to access the interoperability components have access only to the data covered by their access authorisation, by means of individual user identities and confidential access modes only;

(h)ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment;

(i)ensure that it is possible to verify and establish what data have been processed in the interoperability components, when, by whom and for what purpose;

(j)prevent the unauthorised reading, copying, modification or deletion of personal data during the transmission of personal data to or from the interoperability components or during the transport of data media, in particular by means of appropriate encryption techniques;

(k)ensure that, in the event of interruption, installed systems can be restored to normal operation;

(l)ensure reliability by making sure that any faults in the functioning of the interoperability components are properly reported;

(m)monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to internal monitoring to ensure compliance with this Regulation and to assess those security measures in the light of new technological developments.

Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.

Key facts

Type: Regulation · (EU) 2019/818
In force: 1 Jan 1001
Adopted: 20 May 2019
Applies from: 11 Jun 2019
Applies from: 19 May 2025
Text current to: 12 Jun 2026
Applies from: 12 Jun 2026
Made by: Council of the European Union, European Parliament
Official: EUR-Lex 32019R0818 · ELI

Topics

area of freedom, security and justice biometrics data protection EU migration policy exchange of information external border of the EU information system personal data right of asylum Schengen Agreement Free movement of persons Justice and home affairs

History · 1 version

12 Jun 2026Reading

Connections

See on a map

Cited by 12: this act4 provisions; Regulation (EU) 2019/817; Regulation (EU) 2019/8162 provisions; Commission Implementing Decision (EU) 2026/11562 provisions; Commission Implementing Decision (EU) 2026/11552 provisions; Commission Delegated Regulation (EU) 2021/22223 provisions; Commission Delegated Regulation (EU) 2026/49; Commission Delegated Regulation (EU) 2026/483 provisions; Commission Delegated Regulation (EU) 2026/327; Commission Delegated Regulation (EU) 2026/3264 provisions; Emilio De Capitani v Council of the European Union (T-590/23); Commission Implementing Decision (EU) 2025/875

Defined terms · 30

Show every defined term

alphanumeric data
means data represented by letters, digits, special characters, spaces and punctuation marks;
biometric data
means fingerprint data or facial images or both;
biometric template
means a mathematical representation obtained by feature extraction from biometric data limited to the characteristics necessary to perform identifications and verifications;
border authority
means the border guard assigned in accordance with national law to carry out border checks;
border checks
means border checks as defined in point (11) of Article 2 of Regulation (EU) 2016/399;
CIR
means the common identity repository established by Article 17(1) of Regulation (EU) 2019/818;
designated authorities
means the Member States’ designated authorities within the meaning of Article 5 of Regulation (EU) 2024/1358 of the European Parliament and of the Council, Article 3(1), point (26), of Regulation (EU) 2017/2226 of the European Parliament and the Council, Article 4, point (3a), of Regulation (EC) No 767/2008, and Article 3(1), point (21), of Regulation (EU) 2018/1240 of the European Parliament and of the Council;
EES
means the Entry/Exit System established by Regulation (EU) 2017/2226;
ESP
means the European search portal established by Article 6(1) of Regulation (EU) 2019/818 of the European Parliament and of the Council;
ETIAS
means the European Travel Information and Authorisation System established by Regulation (EU) 2018/1240;
Eurodac
means Eurodac established by Regulation (EU) No 603/2013 of the European Parliament and of the Council;
Europol data
means personal data processed by Europol for the purpose referred to in Article 18(2)(a), (b) and (c) of Regulation (EU) 2016/794;
external borders
means external borders as defined in point (2) of Article 2 of Regulation (EU) 2016/399 of the European Parliament and of the Council;
facial image
means digital images of the face;
fingerprint data
means fingerprint images and images of fingerprint latents, which due to their unique character and the reference points contained therein enable accurate and conclusive comparisons on a person's identity;
identification
means the process of determining a person's identity through a database search against multiple sets of data (one-to-many check);
identity data
means the data referred to in Article 27(3)(a) and (b);
Interpol databases
means the Interpol Stolen and Lost Travel Document database (SLTD database) and the Interpol Travel Documents Associated with Notices database (TDAWN database);
match
means the existence of a correspondence as a result of an automated comparison between personal data recorded or being recorded in an information system or database;
MID
means the multiple-identity detector established by Article 25(1) of Regulation (EU) 2019/818;
police authority
means the competent authority as defined in point (7) of Article 3 of Directive (EU) 2016/680;
serious criminal offence
means an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Council Framework Decision 2002/584/JHA, if it is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years;
shared BMS
means the shared biometric matching service established by Article 12(1) of Regulation (EU) 2019/818;
SIS
means the Schengen Information System established by Regulations (EU) 2018/1860, (EU) 2018/1861 and (EU) 2018/1862;
supervisory authorities
means the supervisory authority referred to in Article 51(1) of Regulation (EU) 2016/679 and the supervisory authority referred to in Article 41(1) of Directive (EU) 2016/680;
terrorist offence
means an offence under national law which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541 of the European Parliament and of the Council;
travel document
means a passport or other equivalent document entitling the holder to cross the external borders and to which a visa can be affixed;
travel document data
means the type, number and country of issuance of the travel document, the date of expiry of the validity of the travel document and the three-letter code of the country issuing the travel document;
verification
means the process of comparing sets of data to establish the validity of a claimed identity (one-to-one check);
VIS
means the Visa Information System established by Regulation (EC) No 767/2008 of the European Parliament and of the Council;