support the asylum system, including by assisting in determining which Member State is to be responsible pursuant to Regulation (EU) 2024/1351 for examining an application for international protection registered in a Member State by a third-country national or a stateless person and by facilitating the application of that Regulation under the conditions set out in this Regulation;

assist with the application of Regulation (EU) 2024/1350 under the conditions set out in this Regulation;

assist with the control of irregular immigration to the Union, with the detection of secondary movements within the Union and with the identification of illegally staying third-country nationals and stateless persons for the purpose of determining the appropriate measures to be taken by Member States;

assist with the protection of children, including in the context of law enforcement;

lay down the conditions under which Member States’ designated authorities and the Europol designated authority may request the comparison of biometric or alphanumeric data with those stored in Eurodac for law enforcement purposes for the prevention, detection or investigation of terrorist offences or of other serious criminal offences;

assist in the correct identification of persons registered in Eurodac in accordance with Article 20 of Regulation (EU) 2019/818 by storing identity data, travel document data and biometric data in the common identity repository (CIR);

support the objectives of the European Travel Information and Authorisation System (ETIAS) established by Regulation (EU) 2018/1240;

support the objectives of the Visa Information System (VIS) referred to in Regulation (EC) No 767/2008;

support evidence-based policy making through the production of statistics;

assist with the implementation of Directive 2001/55/EC.

‘applicant for international protection’ means a third-country national or a stateless person who has made an application for international protection as defined in Article 3, point (7), of Regulation (EU) 2024/1347 in respect of which a final decision has not yet been taken;

‘person registered for the purpose of conducting an admission procedure’ means a person who has been registered for the purpose of conducting a resettlement or humanitarian admission procedure in accordance with Article 9(3) of Regulation (EU) 2024/1350;

‘person admitted in accordance with a national resettlement scheme’ means a person resettled by a Member State outside the framework of Regulation (EU) 2024/1350, where that person is granted international protection as defined in Article 3, point (3), of Regulation (EU) 2024/1347 or humanitarian status under national law within the meaning of Article 2(3), point (c), of Regulation (EU) 2024/1350 in accordance with the rules governing the national resettlement scheme;

‘humanitarian status under national law’ means a humanitarian status under national law that provides for rights and obligations equivalent to the rights and obligations set out in Articles 20 to 26 and 28 to 35 of Regulation (EU) 2024/1347;

‘Member State of origin’ means:

‘third-country national’ means any person who is not a citizen of the Union within the meaning of Article 20(1) TFEU and who is not a national of a state which participates in the application of this Regulation by virtue of an agreement with the Union;

‘illegal stay’ means the presence on the territory of a Member State of a third-country national or a stateless person who does not fulfil or no longer fulfils the conditions of entry set out in Article 6 of Regulation (EU) 2016/399 of the European Parliament and of the Council ( 1 ) or other conditions for entry, stay or residence in that Member State;

‘beneficiary of international protection’ means a person who has been granted refugee status as defined in Article 3, point (1), of Regulation (EU) 2024/1347 or subsidiary protection status as defined in Article 3, point (2), of that Regulation;

‘beneficiary of temporary protection’ means a person who enjoys temporary protection as defined in Article 2, point (a), of Directive 2001/55/EC and in a Council Implementing Decision introducing temporary protection or any other equivalent national protection introduced in response to the same event as that Council Implementing Decision;

‘hit’ means the existence of a match or matches established by Eurodac by means of a comparison between biometric data recorded in the computerised central database and those transmitted by a Member State with regard to a person, without prejudice to the requirement that Member States immediately check the results of the comparison pursuant to Article 38(4);

‘National Access Point’ means the designated national system which communicates with Eurodac;

‘Europol Access Point’ means the designated Europol system which communicates with Eurodac;

‘Eurodac data’ means all data stored in Eurodac in accordance with Article 17(1) and (2), Article 19(1), Article 21(1), Article 22(2) and (3), Article 23(2) and (3), Article 24(2) and (3) and Article 26(2);

‘law enforcement’ means the prevention, detection or investigation of terrorist offences or of other serious criminal offences;

‘terrorist offence’ means an offence under national law which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541;

‘serious criminal offence’ means an offence which corresponds or is equivalent to those referred to in Article 2(2) of Framework Decision 2002/584/JHA, if it is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years;

‘fingerprint data’ means the data relating to plain and rolled impressions of the fingerprints of all ten fingers, where present, or a latent fingerprint;

‘facial image data’ means digital images of the face with sufficient image resolution and quality to be used in automatic biometric matching;

‘biometric data’ means fingerprint data or facial image data;

‘alphanumeric data’ means data represented by letters, digits, special characters, space or punctuation marks;

‘residence document’ means any authorisation issued by the authorities of a Member State authorising a third-country national or a stateless person to stay on its territory, including the documents substantiating the authorisation to remain on the territory under temporary protection arrangements or until the circumstances preventing a removal order from being carried out no longer apply, with the exception of visas and residence authorisations issued during the period required to determine the Member State responsible as established in Regulation (EU) 2024/1351 or during the examination of an application for international protection or an application for a residence permit;

‘interface control document’ means a technical document that specifies the necessary requirements with which the National Access Points or the Europol Access Point are to comply in order to be able to communicate electronically with Eurodac, in particular by detailing the format and possible content of the information to be exchanged between Eurodac and the National Access Points or the Europol Access Point;

‘CIR’ means the common identity repository as established by Article 17(1) and (2) of Regulation (EU) 2019/818;

‘identity data’ means the data referred to in Article 17(1), points (c) to (f) and (h), Article 19(1), points (c) to (f) and (h), Article 21(1), points (c) to (f) and (h), Article 22(2), points (c) to (f) and (h), Article 23(2), points (c) to (f) and (h), Article 24(2), points (c) to (f) and (h), and Article 26(2), points (c) to (f) and (h);

‘dataset’ means the set of information recorded in Eurodac on the basis of Article 17, 19, 21, 22, 23, 24 or 26, corresponding to one set of fingerprints of a data subject and composed of biometric data, alphanumeric data and, where available, a scanned colour copy of an identity or travel document;

‘child’ or ‘minor’ means a third-country national or a stateless person below the age of 18 years.

a Central System composed of:

a communication infrastructure between the Central System and Member States that provides a secure and encrypted communication channel for Eurodac data (the ‘Communication Infrastructure’);

the CIR;

a secure communication infrastructure between the Central System and the central infrastructures of the European search portal and between the Central System and the CIR.

for diagnostics and repair when faults are discovered in Eurodac; or

for testing new technologies and techniques relevant to enhancing the performance of Eurodac or the transmission of data to it.

supervision;

security;

the coordination of relations between the Member States and the provider.

implementation of the budget;

acquisition and renewal;

contractual matters.

the number of applicants and the number of first-time applicants resulting from the linking process referred to in Article 3(6);

the number of rejected applicants resulting from the linking process referred to in Article 3(6) and pursuant to Article 17(2), point (j);

the number of persons who have been disembarked following search and rescue operations;

the number of persons who have been registered as beneficiaries of temporary protection;

the number of applicants who have been granted international protection in a Member State;

the number of persons who have been registered as minors;

the number of persons referred to in Article 18(2), point (a), of this Regulation who have been admitted under Regulation (EU) 2024/1350;

the number of persons referred to in Article 20(1) who have been admitted under a national resettlement scheme;

the number of datasets transmitted on persons as referred to in Article 15(1), Article 18(2), points (b) and (c), Article 22(1), Article 23(1), Article 24(1) and Article 26(1);

the number of transmissions of data relating to persons as referred to in Articles 18(1);

the number of hits for persons as referred to in Article 15(1) of this Regulation:

the number of hits for persons as referred to in Article 18(1) of this Regulation:

the number of hits for persons as referred to in Article 22(1) of this Regulation:

the number of hits for persons as referred to in Article 23(1) of this Regulation:

the number of hits for persons as referred to in Article 24(1) of this Regulation:

the number of hits for persons as referred to in Article 26(1) of this Regulation:

the number of biometric data which Eurodac had to request more than once from the Member States of origin because the biometric data originally transmitted did not lend themselves to comparison using the computerised fingerprint and facial image recognition systems;

the number of datasets marked and unmarked in accordance with Article 31(1), (3) and (4);

the number of hits for persons as referred to in Article 31(1) and (4) for whom hits have been recorded under paragraph 1, points (k) to (p), of this Article;

the number of requests and hits as referred to in Article 33(1);

the number of requests and hits as referred to in Article 34(1);

the number of requests made in accordance with Article 43;

the number of hits received from Eurodac as referred to in Article 38(6).

upon the registration of the application for international protection referred to in Article 27 of Regulation (EU) 2024/1348 and transmit them, as soon as possible and no later than 72 hours from that registration, together with the other data referred to in Article 17(1) of this Regulation, to Eurodac in accordance with Article 3(2) of this Regulation; or

upon the making of the application for international protection, where the application is made at external border crossing points or in transit zones by a person who does not fulfil the entry conditions set out in Article 6 of Regulation (EU) 2016/399, and transmit them, as soon as possible and no later than 72 hours after the biometric data have been taken, together with the data referred to in Article 17(1) of this Regulation, to Eurodac in accordance with Article 3(2) of this Regulation.

when an applicant for international protection arrives in the Member State responsible following a transfer pursuant to a decision acceding to a take charge request as referred to in Article 40 of Regulation (EU) 2024/1351, the Member State responsible shall send a dataset recorded in accordance with Article 17 of this Regulation relating to the person concerned and shall include his or her date of arrival;

when an applicant for international protection or another person as referred to in Article 36(1), point (b) or (c), of Regulation (EU) 2024/1351 arrives in the Member State responsible following a transfer pursuant to a take back notification as referred to in Article 41 of that Regulation, the Member State responsible shall update its dataset recorded in accordance with Article 17 of this Regulation relating to the person concerned by adding his or her date of arrival;

as soon as the Member State of origin establishes that the person concerned whose data were recorded in Eurodac in accordance with Article 17 of this Regulation has left the territory of the Member States, it shall update its dataset recorded in accordance with Article 17 of this Regulation relating to the person concerned by adding the date when that person left the territory, in order to facilitate the application of Article 37(4) of Regulation (EU) 2024/1351;

as soon as the Member State of origin ensures that the person concerned whose data were recorded in Eurodac in accordance with Article 17 of this Regulation has left the territory of the Member States in compliance with a return decision or removal order issued following the withdrawal or rejection of the application for international protection as provided for in Article 37(5) of Regulation (EU) 2024/1351, it shall update its dataset recorded in accordance with Article 17 of this Regulation relating to the person concerned by adding the date of his or her removal or when he or she left the territory.

fingerprint data;

a facial image;

surname(s) and forename(s), name(s) at birth and previously used names and any aliases, which may be entered separately;

nationality(ies);

date of birth;

place of birth;

Member State of origin, place and date of the application for international protection; in the cases referred to in Article 16(2), point (a), the date of application shall be the date entered by the Member State who transferred the applicant;

sex;

where available, the type and number of identity or travel document, the three letter code of the issuing country and the expiry date of that document;

where available, a scanned colour copy of an identity or travel document along with an indication of its authenticity or, where unavailable, another document which facilitates the identification of the third-country national or stateless person along with an indication of its authenticity;

the reference number used by the Member State of origin;

the date on which the biometric data were taken;

the date on which the data were transmitted to Eurodac;

operator user ID.

the Member State responsible in the cases referred to in Article 16(1), (2) or (3);

the Member State of relocation in accordance with Article 25(1);

in the cases referred to in Article 16(2), point (a), the date of the arrival of the person concerned after a successful transfer;

in the cases referred to in Article 16(2), point (b), the date of the arrival of the person concerned after a successful transfer;

in the cases referred to in Article 16(2), point (c), the date when the person concerned left the territory of the Member States;

in the cases referred to in Article 16(2), point (d), the date when the person concerned was removed from or left the territory of the Member States;

in the cases referred to in Article 25(2), the date of arrival of the person concerned after a successful transfer;

the fact that a visa was issued to the applicant, the Member State which issued or extended the visa or on behalf of which the visa was issued and the visa application number;

the fact that the person could pose a threat to internal security following the security check referred to in Regulation (EU) 2024/1356 of the European Parliament and of the Council ( 4 ) or following an examination pursuant to Article 16(4) of Regulation (EU) 2024/1351 or to Article 9(5) of Regulation (EU) 2024/1348, if any of the following circumstances apply:

the fact that the application for international protection has been rejected where the applicant has no right to remain and has not been allowed to remain in a Member State pursuant to Regulation (EU) 2024/1348;

the fact that, following an examination of an application in the border procedure pursuant to Regulation (EU) 2024/1348, a decision rejecting an application for international protection as inadmissible, unfounded or manifestly unfounded or a decision declaring an application as implicitly or explicitly withdrawn has become final;

the fact that assistance for voluntary return and reintegration (AVRR) has been granted.

fingerprint data;

a facial image;

surname(s) and forename(s), name(s) at birth and previously used names and any aliases, which may be entered separately;

nationality(ies);

date of birth;

place of birth;

Member State of origin, place and date of the apprehension;

sex;

where available, the type and number of identity or travel document, the three letter code of the issuing country and the expiry date of that document;

where available, a scanned colour copy of an identity or travel document along with an indication of its authenticity or, where unavailable, another document which facilitates the identification of the third-country national or stateless person along with an indication of its authenticity;

the reference number used by the Member State of origin;

the date on which the biometric data were taken;

the date on which the data were transmitted to Eurodac;

operator user ID.

in accordance with paragraph 7 of this Article, the date when the person concerned left or was removed from the territory of the Member States;

the Member State of relocation in accordance with Article 25(1);

the fact that AVRR has been granted,

the fact that the person could pose a threat to internal security, following the screening referred to in Regulation (EU) 2024/1356, if any of the following circumstances apply:

fingerprint data;

a facial image;

surname(s) and forename(s), name(s) at birth and previously used names and any aliases, which may be entered separately;

nationality(ies);

date of birth;

place of birth;

Member State of origin, place and date of the apprehension;

sex;

where available, the type and number of identity or travel document, the three letter code of the issuing country and the expiry date of that document;

where available, a scanned colour copy of an identity or travel document along with an indication of its authenticity or, where unavailable, another document which facilitates the identification of the third-country national or stateless person along with an indication of its authenticity;

the reference number used by the Member State of origin;

the date on which the biometric data were taken;

the date on which the data were transmitted to Eurodac;

operator user ID.

in accordance with paragraph 6 of this Article, the date when the person concerned left or was removed from the territory of the Member States;

the Member State of relocation in accordance with Article 25(1);

where applicable, in the cases referred to in Article 25(2), the date of arrival of the person concerned after a successful transfer;

the fact that AVRR has been granted;

the fact that the person could pose a threat to internal security, following the screening referred to in Regulation (EU) 2024/1356 or following a security check carried out at the moment of taking the biometric data as provided for in paragraph 1 of this Article, if any of the following circumstances apply:

fingerprint data;

a facial image;

surname(s) and forename(s), name(s) at birth and previously used names and any aliases, which may be entered separately;

nationality(ies);

date of birth;

place of birth;

Member State of origin, place and date of disembarkation;

sex;

the reference number used by the Member State of origin;

the date on which the biometric data were taken;

the date on which the data were transmitted to Eurodac;

operator user ID.

the type and number of identity or travel document, the three letter code of the issuing country and the expiry date of that document;

a scanned colour copy of an identity or travel document along with an indication of its authenticity or, where unavailable, another document which facilitates the identification of the third-country national or stateless person along with an indication of its authenticity;

in accordance with paragraph 7 of this Article, the date when the person concerned left or was removed from the territory of the Member States;

the Member State of relocation in accordance with Article 25(1);

the fact that AVRR has been granted;

the fact that the person could pose a threat to internal security following the screening referred to in Regulation (EU) 2024/1356, if any of the following circumstances apply:

fingerprint data;

a facial image;

surname(s) and forename(s), name(s) at birth and previously used names and any aliases, which may be entered separately;

nationality(ies);

date of birth;

place of birth;

Member State of origin, place and date of registration as beneficiary of temporary protection;

sex;

where available, the type and number of identity or travel document, the three letter code of the issuing country and the expiry date of that document;

where available, a scanned colour copy of an identity or travel document along with an indication of its authenticity or, where unavailable, another document;

the reference number used by the Member State of origin;

the date on which the biometric data were taken;

the date on which the data were transmitted to Eurodac;

operator user ID;

where relevant, the fact that the person previously registered as a beneficiary of temporary protection falls under one of the exclusion grounds set out in Article 28 of Directive 2001/55/EC;

the reference of the relevant Council Implementing Decision.

a prior check has been conducted in:

the comparison is necessary for the purpose of the prevention, detection or investigation of terrorist offences or of other serious criminal offences, which means that there is an overriding public security concern which makes the searching of the database proportionate to the objective pursued;

the comparison is necessary in a specific case including specific persons; and

there are reasonable grounds to consider that the comparison will substantially contribute to the prevention, detection or investigation of any of the terrorist offences or other serious criminal offences in question; such reasonable grounds exist in particular where there is a substantiated suspicion that the suspect, perpetrator or victim of a terrorist offence or other serious criminal offence falls within a category covered by this Regulation.

comparisons with biometric or alphanumeric data stored in any information processing systems that are technically and legally accessible by Europol did not lead to the establishment of the identity of the data subject;

the comparison is necessary to support and strengthen action by Member States in preventing, detecting or investigating terrorist offences or other serious criminal offences falling under Europol’s mandate, which means that there is an overriding public security concern which makes the searching of the database proportionate to the objective pursued;

the comparison is necessary in a specific case including specific persons; and

there are reasonable grounds to consider that the comparison will substantially contribute to the prevention, detection or investigation of any of the terrorist offences or other serious criminal offences in question; such reasonable grounds exist in particular where there is a substantiated suspicion that the suspect, perpetrator or victim of a terrorist offence or other serious criminal offence falls within a category covered by this Regulation.

biometric data and the other data referred to in Article 17(1) and (2), Article 19(1), Article 21(1), Article 22(2) and (3), Article 23(2) and (3), Article 24(2) and (3) and Article 26(2) are taken lawfully and are lawfully transmitted to Eurodac;

data are accurate and up to date when they are transmitted to Eurodac;

without prejudice to the responsibilities of eu-LISA, data in Eurodac are lawfully recorded, stored, rectified and erased;

the results of biometric data comparisons transmitted by Eurodac are lawfully processed.

adopt measures ensuring that all persons, including contractors, working with Eurodac process the data recorded therein only in accordance with the purposes of Eurodac laid down in Article 1;

take the necessary measures to ensure the security of Eurodac in accordance with Article 48;

ensure that only persons authorised to work with Eurodac have access thereto, without prejudice to the competences of the European Data Protection Supervisor.

the identity and contact details of the controller within the meaning of Article 4, point (7), of Regulation (EU) 2016/679 and of his or her representative, if any, and the contact details of the data protection officer;

the data to be processed in Eurodac and the legal basis for processing, including a description of the aims of Regulation (EU) 2024/1351, in accordance with Article 19 of that Regulation and, where applicable, of the aims of Regulation (EU) 2024/1350, and an explanation in an intelligible form of the fact that Eurodac may be accessed by the Member States and Europol for law enforcement purposes;

in relation to a person covered by Article 15(1), Article 22(1), Article 23(1) or Article 24(1), the fact that, if a security check as referred to in Articles 17(2), point (i), 22(3), point (d), Article 23(3), point (e), and Article 24(3), point (f), shows that he or she could pose a threat to internal security, the Member State of origin is obliged to register that fact in Eurodac;

the recipients or categories of recipients of the data, if any;

in relation to a person covered by Article 15(1), Article 18(1) and (2), Article 20(1), Article 22(1), Article 23(1), Article 24(1) or Article 26(1), the obligation to have his or her biometric data taken and the relevant procedure, including the possible implications of non-compliance with such an obligation;

the period for which the data will be stored pursuant to Article 29;

the existence of the right to request from the controller access to data relating to him or her, and the right to request the rectification of inaccurate personal data, the completion of incomplete personal data or the erasure or restriction of the processing of unlawfully processed personal data concerning the data subject, as well as the right to receive information on the procedures for exercising those rights including the contact details of the controller and the supervisory authorities referred to in Article 44(1);

the right to lodge a complaint with the supervisory authority.

physically protect the data, including by making contingency plans for the protection of critical infrastructure;

deny unauthorised persons access to data-processing equipment and national installations in which the Member State carries out operations in accordance with the purposes of Eurodac (equipment, access control and checks at entrance to the installation);

prevent the unauthorised reading, copying, modification or removal of data media (data media control);

prevent the unauthorised input of data and the unauthorised inspection, modification or erasure of stored personal data (storage control);

prevent the use of automated data-processing systems by unauthorised persons using data communication equipment (user control);

prevent the unauthorised processing of data in Eurodac and any unauthorised modification or erasure of data processed in Eurodac (control of data entry);

ensure that persons authorised to access Eurodac have access only to the data covered by their access authorisation, by means of individual and unique user IDs and confidential access modes only (data access control);

ensure that all authorities with a right of access to Eurodac create profiles describing the functions and responsibilities of persons who are authorised to access, enter, update, erase and search the data, and make those profiles and any other relevant information which those authorities might require for supervisory purposes available to the supervisory authorities referred to in Article 51 of Regulation (EU) 2016/679 and in Article 41 of Directive (EU) 2016/680, without delay, at their request (personnel profiles);

ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment (communication control);

ensure that it is possible to verify and establish what data have been processed in Eurodac, when, by whom and for what purpose (control of data recording);

prevent the unauthorised reading, copying, modification or deletion of personal data during the transmission of personal data to or from Eurodac or during the transport of data media, in particular by means of appropriate encryption techniques (transport control);

ensure that installed systems may, in the event of interruption, be restored (recovery);

ensure that Eurodac performs its functions, that the appearance of faults in the functions is reported (reliability) and that stored personal data cannot be corrupted by means of the system malfunctioning (integrity); and

monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to internal monitoring in order to ensure compliance with this Regulation (self-auditing) and to automatically detect within 24 hours any relevant events arising from the application of measures listed in points (b) to (k) that might indicate the occurrence of a security incident.

the data are transferred or made available solely for the purpose of identifying, and issuing an identification or travel document to, an illegally staying third-country national for the purposes of return; and

the third-country national concerned has been informed that his or her personal data may be shared with the authorities of a third country.

the exact purpose of the request for comparison, including the type of terrorist offence or other serious criminal offence concerned and, for Europol, the exact purpose of the request for comparison;

the reasonable grounds given in accordance with Article 33(1), point (a), of this Regulation for not conducting comparisons with other Member States under Decision 2008/615/JHA;

the national file number;

the date and exact time of the request for comparison by the National Access Point to Eurodac;

the name of the authority that requested access for comparison and the person responsible who made the request and processed the data;

where applicable, the use of the urgent procedure referred to in Article 32(4) and the decision taken with regard to the ex post verification;

the data used for comparison;

in accordance with national rules or with Regulation (EU) 2016/794, the identifying mark of the official who carried out the search and of the official who ordered the search or supply;

where applicable, a reference to the use of the European search portal to query Eurodac as referred to in Article 7(2) of Regulation (EU) 2019/818.

the exact purpose of the comparison, including the type of terrorist offence or other serious criminal offence;

grounds given for substantiated suspicion;

the reasonable grounds given in accordance with Article 33(1), point (a), of this Regulation for not conducting comparisons with other Member States under Decision 2008/615/JHA;

the number of requests for comparison;

the number and type of cases which have ended in successful identifications; and

the need and use made of the exceptional case of urgency, including those cases where that urgency was not accepted by the ex post verification carried out by the verifying authority.

the nature of data subject to processing;

the expected impact of providing access to the data listed in Article 26(2) to the designated authorities referred to in Articles 5(1) and 9(1); and

the safeguards provided for in this Regulation.