A border refusal, an unexpected detention, or a banking compliance query can raise an immediate question: does INTERPOL share personal data? The short answer is yes, but not without a legal framework. INTERPOL processes and disseminates criminal-police information through controlled channels, for specified purposes and subject to its Rules on the Processing of Data (RPD). The practical position, however, depends heavily on what data exist, how they were entered, and which authorities or organisations may have received or acted upon them.
For an individual affected by a Red Notice, Diffusion or another INTERPOL record, the distinction matters. Data may be unavailable to the public yet visible to police and border authorities. Conversely, a publicly searchable Red Notice is not the same thing as an international arrest warrant, nor does it reveal the full INTERPOL file.
Does INTERPOL share personal data with member countries?
INTERPOL is an intergovernmental organisation that facilitates police co-operation. It does not itself arrest, prosecute or determine extradition. Its principal operational role is to enable authorised law-enforcement bodies in member countries to exchange information relevant to crime prevention and investigation.
Personal data held in INTERPOL systems may be made available to National Central Bureaus (NCBs), which are the designated INTERPOL contact points in each member country, and to other authorised users where the applicable rules permit it. Exchange commonly takes place through INTERPOL’s secure police communications infrastructure. Access is not equivalent to unrestricted distribution: permissions, purpose limitations and access controls apply to different categories of data.
A Red Notice is a request to locate and provisionally arrest a person pending extradition, surrender or similar legal action. It is not an international arrest warrant and does not oblige every country to make an arrest. Nevertheless, information associated with a Red Notice can be accessible to authorised law-enforcement users and may lead to action under domestic law when a person crosses a border or encounters police.
A Diffusion can create similar practical risks. Unlike a Notice, a Diffusion is circulated directly by an NCB to selected foreign counterparts or international entities through INTERPOL channels. It may therefore be received by fewer recipients than a Notice, but this does not make its consequences insignificant. Its legal compatibility with INTERPOL’s rules remains capable of challenge.
Which personal data can be shared through INTERPOL?
The answer is not confined to a name and date of birth. Depending on the purpose of the record, INTERPOL data may include identity details, nationality, travel document information, photographs, biometric identifiers, contact information, criminal allegations, judicial references and information concerning requested action. Data must be relevant, adequate and not excessive for the stated police-co-operation purpose.
The RPD also impose heightened restrictions on sensitive categories of information. The fact that a national authority possesses information does not mean it may automatically be recorded or circulated through INTERPOL. Data processing must comply with INTERPOL’s Constitution, including the requirement to respect the spirit of the Universal Declaration of Human Rights, and with the RPD’s rules on quality, relevance, retention and access.
That framework is particularly important where an allegation appears to arise from a private commercial dispute, a family dispute, debt enforcement, immigration matters, or conduct with a predominantly political character. The formal label placed on a case by a requesting country is not decisive. INTERPOL must assess whether the underlying data are compatible with its rules, including Article 3 of its Constitution, which prohibits intervention or activities of a political, military, religious or racial character.
Public visibility is different from police access
A frequent source of confusion is the difference between a public Red Notice and an INTERPOL record. INTERPOL publishes only some Red Notices on its public website. A person may have an active Red Notice, Diffusion or other data in INTERPOL systems without appearing in a public search.
Equally, the publication of a Red Notice does not establish that every detail held by INTERPOL is public. Public notices are generally limited extracts. The underlying record may contain additional identifying information, judicial particulars, restrictions on access, or communications between authorities.
INTERPOL does not operate as a general commercial database for employers, banks or members of the public. Yet data held by police authorities can have indirect consequences. A border authority may act on an alert; an immigration decision may be affected by information lawfully obtained through official channels; and compliance concerns can arise where public reporting, domestic proceedings or separate databases create a risk indicator. Each route needs to be examined carefully rather than assumed.
What safeguards apply when INTERPOL processes data?
INTERPOL’s data-protection regime is distinct from domestic data-protection law, although it reflects familiar principles: lawful processing, defined purpose, data quality, security, limited retention and individual oversight. The RPD require information in INTERPOL’s files to remain accurate, relevant and up to date. Data that are no longer necessary, or that do not comply with the rules, should not remain in the system simply because they were initially supplied by a member country.
The source country retains an important role. It may be asked to clarify the legal basis for its request, provide judicial documentation, correct inaccuracies or confirm whether proceedings remain active. But INTERPOL is not required to preserve data merely because the source country wishes it to do so. Its constitutional and data-processing rules create independent standards.
There are limits to transparency. INTERPOL may withhold information where disclosure could prejudice investigations, public or national security, the rights of third parties, or the proper functioning of police co-operation. This means that an access response may not disclose every item or reveal every recipient. A refusal to provide full information is not, by itself, proof that the data are lawful or unlawful. It may require a focused assessment of the procedural basis and available evidence.
How can you find out what INTERPOL holds?
An individual may submit a request to the Commission for the Control of INTERPOL’s Files (CCF), the independent body responsible for reviewing requests concerning personal data processed in INTERPOL’s files. The CCF’s Requests Chamber considers applications for access, correction and deletion.
An access request should be prepared with care. It should establish identity, explain the reason for the request clearly, and provide enough information to enable the CCF to identify any possible record. Where there has been detention, a border incident, a failed visa application or information from domestic counsel, supporting documents can help define the issue without making assumptions about what data exist.
The CCF procedure is not an ordinary subject access request. It is governed by INTERPOL’s own rules and confidentiality arrangements. A response may confirm, deny or limit disclosure depending on the circumstances. Where information is identified, the next question is whether the proper remedy is correction, revision, deletion or a separate challenge to the underlying data.
Correction, revision and deletion are different remedies
Not every problem requires deletion. If identity information, judicial references, passport details or the status of proceedings are inaccurate, a request for correction or revision may be appropriate. Where a notice or Diffusion is no longer justified, does not meet RPD requirements, is disproportionate, or conflicts with INTERPOL’s constitutional safeguards, deletion may be sought.
A well-supported deletion request ordinarily addresses both law and evidence. It may need to examine the nature of the alleged offence, the procedural history, the reliability of supporting material, the present status of domestic proceedings, any human-rights concerns, and whether the matter is in substance political, civil or otherwise outside INTERPOL’s permitted remit.
The consequences of imprecise submissions can be serious. Seeking deletion where a limited correction would resolve the immediate problem may delay an outcome. Equally, accepting an offer to correct peripheral details should not obscure a more fundamental challenge to the lawfulness of the record.
Practical steps if you suspect data have been shared
Preserve the facts before they disappear. Keep copies of any refusal at a border, detention paperwork, correspondence from an authority, visa decision, or notice received from a court. Record dates, locations and the authority involved. Avoid attempting to obtain information through informal contacts or posting allegations publicly, as this can complicate an already sensitive matter.
If international travel is unavoidable, the legal position should be assessed before departure. Whether travel presents a realistic risk depends on the specific INTERPOL record, the countries involved, domestic arrest law, extradition arrangements and any local proceedings. No general answer can safely substitute for case-specific advice.
Konstantina Zivla, international criminal-defence lawyer and founder of Red Notice Track, advises on access requests, CCF submissions and challenges to INTERPOL data. The first objective is often straightforward: establish what exists, identify who may be able to see it, and take informed steps to regain control of the situation.
