What is PNR: Passenger Name Record Explained in Details

It happens every time travelers book a flight. No matter whether they eventually buy tickets and board a plane or cancel the reservation and stay home, the deed is done. Data on them has been collected and saved in the form of a passenger name record or PNR.

Introduced to facilitate the exchange of booking information between airlines, PNRs have become an important component of the travel industry. They act as booking confirmation, a repository of valuable commercial information, and even a weapon against global terrorism.

This article describes the important technical and legal aspects of PNR creation and usage. It takes a close look at its content, touches on some privacy concerns, and peeks into the future of travel records.

PNR meaning and lifecycle

A passenger name record, also called a booking file, is a digital document with details of the itinerary for a passenger or a group of passengers traveling together. It’s an essential part of the flight booking process that precedes and enables ticketing.

Nobody can book a flight, pay for a ticket, and get on a plane without a PNR. In the most basic scenario, a PNR makes the following steps during its lifecycle.

PNR as a part of the flight booking process.

1. Data collection. The essential trip data is gathered when an individual passenger or organization books a flight via a travel retailer — a carrier’s website, online travel agency (OTA), travel management company (TMC), tour operator, or other channels.

2. Data submission to the CRS. The reservation data is transmitted to the airline’s central reservation system (CRS). Most airlines don’t run their own CRS. Instead, they host inventory and manage bookings on one of the major global distribution systems (GDSs) — Amadeus, Sabre, or Travelport — which function as data warehouses and aggregators. You may learn more about the main GDSs from our dedicated video.

3. Initial PNR generation. A carrier’s operator or authorized travel agent logs into the CRS/GDS to build a PNR file with five mandatory elements (to be discussed later in the section about PNR data).

4. Booking reference or PNR code assignment. The system generates a booking reference — a unique alphabetic or alphanumeric code assigned to the PNR file. It serves as a digital address of the document in the airline’s database.

5. Booking confirmation. The travel retailer sends an e-mail with the PNR code (booking reference) to the passenger as a reservation confirmation. The airline ticket will be issued only after the passenger pays the fare.

6. Updates and addition of new details. If required, the agent or operator adds new data elements or makes changes to the record. Generally, the PNR is updated every time the reservation information is altered.

7. Archiving. When the trip ends, the PNR is automatically archived. Usually, it happens within one to five days after the final segment of the itinerary is completed.

The first PNR generated by Amadeus, January 7, 1992 for “Wolfgang Amadeus”. Source: Amadeus for Developers

What is PNR number, booking reference, reservation code, and record locator?

Most passengers have never seen a PNR file itself. What they deal with is a PNR number or code assigned to each PNR file upon creation. It may appear under different names — a record locator, booking reference, reservation code, or just PNR.

No matter what you call it, the code usually contains six characters — letters or letters and numbers, depending on the system used to make a booking. Sabre sticks to letters only; Amadeus and Galileo generate alphanumeric strings.

A unique booking reference is emailed to passengers after they complete a reservation and can be found on e-tickets and boarding passes. It enables travelers to manage their bookings and check in online. The code also gives travelers access to their flight details but not to PNR files with personal information.

Receipt for booking confirmation where 01FH53 is the record locator or PNR number. Source: Bank Info Security

Though PNR codes look like random mixtures of characters, in fact, airlines apply special algorithms to place the letters and numbers in a certain sequence and avoid duplicating already existing combinations. When generating references, carriers also strive to recognize and censor profanity. Codes can be repeated but only long after the trip under the same PNR is completed.

Why airlines need Super PNRs

The trip may contain multiple flights operated by different carriers — let alone car rentals, hotel reservations, and other travel services. In this case, a CRS receiving a reservation request lacks data to cover all segments of the itinerary.

For this problem, there is a solution. The initial CRS creates a Super PNR or Master Itinerary and sends copies to providers involved in the multileg flight. Each carrier manages its portion of the trip and saves the updated document in its database, identifying it with a separate record locator.

Super PNR connects all parts of the multileg trip.

Eventually, all participants send record locators (PNR numbers) back to the Super PNR holder, connecting documents related to a particular itinerary and ensuring the exchange of updates. As a result, the same trip can get several PNR numbers in different reservation systems. A passenger receives a booking reference to the Super PNR that combines all parts of the trip.

A PNR multiplies each time several systems are involved in the reservation. If, for example, a travel agent uses Amadeus to book a flight operated by a Sabre-hosted carrier, there will be at least two PNRs with their own record locators. The entire process gets much simpler when agents and all providers serving the itinerary use the same GDS. This enables sharing a single PNR with just one record locator rather than creating multiple copies under different codes.

Now, that we've addressed key technical details and terms, let’s proceed to the most essential thing about PNRs — their content.

PNR full form: Passenger name record data

Standards for the PNR were initially developed by the International Air Transport Association (IATA), the International Civil Aviation Organization (ICAO), and Airlines for America, previously known as the Air Transport Association of America (ATA). For those who want to better understand the role of IATA in the travel industry, we’ve prepared an educational video.

However, neither IATA nor any other international organization dictates a universal format, exact number, and order of information pieces for PNRs. These bodies also don’t put restrictions on the number of characters to be used for each data element.

Due to the absence of unified rules, the file size and its content vary greatly from system to system and may reach as many as 999 data elements if you create a PNR in Amadeus. Regardless of the platform, much fewer components are used in practice, and only five of them are mandatory to comply with IATA/ICAO requirements.

Key data components of a PNR file.

Mandatory data elements

To easily recall the most essential data elements, Sabre suggests using the acronym PRINT, which stands for:

• phone either a traveler's or travel agent's to enable contact;
• received from field indicating the last person who has made changes in the PNR, typically a passenger or travel agent;
• itinerary that must include at least one segment of the journey;
• name of a passenger or passengers, containing the full first and last name (the middle name is not required); and
• ticketing specifying how and when a ticket is to be issued.

The mandatory elements can be arranged in any order and modified at any time after the booking is made. In the absence of at least one of them, it’s impossible to complete a reservation, create a PNR, and obtain a record locator.

Optional data elements

Mandatory parts contain essential trip details, describing where and when a particular passenger intends to fly. Optional components are added according to the commercial needs of airlines and may include

• additional itinerary segments that can be a flight, hotel reservation, car rental, etc.;
• payment method (cash, credit/debit card, or check);
• credit card number;
• passenger email address;
• frequent flyer number;
• travel agency name and address;
• fare and pricing details;
• restrictions that may apply to the ticket;
• age details relevant to the travel (for example, unaccompanied children or elderly people who need assistance);
• special service requests (SSRs) like meal or seating preferences;
• agency service fees;
• other remarks related to the trip; and
• historical changes to the PNR.

A payment method, also called a form of payment, is one of the most important optional elements since it’s mandatory to issue a ticket and complete the booking process. This information is added to the PNR file after a passenger pay for the flight.

In different CRSs and GDSs, the same data elements can be presented under different names and in a different order, split into two fields or, vice versa, grouped under one heading. This striking diversity hampers the effective evaluation and processing of data collected by airlines. So, when security bodies decided to systematically review PNRs as a part of counter-terrorism measures, they insisted on the implementation of a special field with a strict structure.

Secure flight passenger data and advance passenger information systems

In 2009, the US Transportation Security Administration (TSA) implemented the Secure Flight program to screen passengers before they board aircraft flying to, from, or over the United States. Under this mandate, PNRs of travelers making for the Land of Liberty must contain secure flight passenger data (SFPD) elements — such as:

• full name with the middle name or initial if it appears on the ID card, passport, driver’s license, or another valid identity document with the photo;
• date of birth;
• gender; and
• redress number issued by the (TSA) to facilitate identity checks. This unique number is particularly important if a passenger has a common name shared by many people or if he or she has already been misidentified in the past when crossing US borders.

The Secure Flight final rule obligates airlines to enter SFPD in the PNR and transmit it to the TSA at least 72 hours before the flight departure. If the bookings are created within 72 hours, carrier operators must gather and provide the information as soon as possible.

Then, the Secure Flight Program matches the SFPD portion against watchlists maintained by the Terrorist Screening Center. Based on the results, the passenger undergoes expedited, normal, or additional screening at the checkpoint or is denied boarding.

Secure Flight screening facilitated by the TSA PreCheck program. Source: Papers, Please!

Besides that, the US and more than 60 other countries require airlines to collect advance passenger information (API) that includes data travelers have to reveal at the border control — passport details, citizenship, place of residence, and even the address of the first night spent in the country for travelers to the US.

Some of the API elements can be extracted from the PNR. Moreover, both are often regulated by the same documents. In the EU countries, the use of PNR and API data for crime and terrorism prevention is ruled by the PNR Directive issued in 2016. However, advance passenger information has nothing to do with the convenience of carriers and benefits security authorities rather than airlines.

Commercial use of PNR data and privacy concerns

While PNR data is extensively used to fight terrorism, its commercial application is limited by privacy concerns. Data-rich records capturing the habits and behavior patterns of passengers seem like a gold mine for training machine learning models that will help airlines with dynamic pricing, customer segmentation, and other complex tasks.

However, strict data privacy regulations hinder airlines from sharing information with research centers, start-ups, and IT vendors to create data-driven apps and extract valuable business insights. Say, the above-mentioned PNR Directive prohibits processing sensitive data like special meal requests or seat preferences. All PNRs must be depersonalized six months after the trip and deleted in five years.

In the US, PNR data obtained from commercial carriers is stored in the Automated Targeting System. Just as in the EU, PNRs are depersonalized after six months. In five years, records are moved to a dormant database where they remain available for another ten years — for security purposes only.

In truth, “PNRs cannot be deleted,“ Edward Hasbrouck, travel expert and author of the Practical Nomad book, argues. “Once created, they are archived and retained in the CRS/GDS, and can still be viewed, even if you never bought a ticket," he explains. "To cancel or delete a data element in a PNR means to move it from the live portion of the PNR to the permanent history portion. To cancel an entire PNR means to move it from active storage to archival storage.”

So, PNR data accumulated over the years can eventually be used — by criminals, by government bodies, or on a good day by commercial structures.

The future of PNR: One Order

The future of PNRs is likely to be engineered by ONE Order — an extension of IATA’s New Distribution Capability (NDC) program facilitating the direct distribution of travel products and smooth data exchange among different platforms.

Currently, airlines have to deal with three types of travel records — PNRs focusing on itinerary details, e-tickets capturing payment information, and electronic miscellaneous documents (EMDs) with the list of purchased ancillaries. These documents are created in the legacy EDIFACT format used across the airline industry. Moreover, they are stored in different back-office systems, which adds complexity and increases expenses for carriers.

In a ONE Order world, all travel data in question will be captured in a single XML file by a single system. This will make things far easier for all providers and travel agents. IATA expects that its initiative will see widespread adoption by 2025. But even if these expectations are too optimistic, there won't be any backtracking.

If you want to learn more, watch our video detailing how online booking unfolds offscreen.