INTERPOL Rules on the Processing of Data: How They Work and Who They Protect
Imagine checking your email one morning and learning that your name appears in an INTERPOL notice. Maybe a bank flagged it, maybe a border officer mentioned it, maybe a lawyer wrote to you. The first question is almost always the same: who decides what goes into that database, how long it stays there, and what can be done if the information is wrong? That is exactly what the INTERPOL Rules on the Processing of Data are designed to answer. This article explains the rulebook in plain language — what it covers, who must follow it, which bodies supervise it, and how an individual can challenge data they believe is unlawful.
The short answer is this: INTERPOL operates a set of binding data-protection rules that govern every piece of information processed through its channels. Those rules apply to the General Secretariat, to National Central Bureaus, and to the officials who handle notices, diffusions, and criminal-analysis files. Independent oversight bodies — the Commission for the Control of Files and the Control Commission for INTERPOL’s Information System — review compliance and can order corrections or deletions. If you are dealing with an INTERPOL data problem, legal specialists such as interpol-stop.com assist clients with Red Notice removal, CCF complaints, and challenges to INTERPOL Diffusions, working directly within this framework.
Where the INTERPOL Rules on the Processing of Data Sit in the Legal Framework
INTERPOL is not a court and it is not a police force. It is an international organisation that facilitates police cooperation between its member countries. Because it handles personal data on a global scale, it has built its own internal legal architecture to regulate that activity. The Rules on the Processing of Data are the central instrument in that architecture. They sit alongside the Constitution, the Rules of Procedure, and the specific rules governing the processing of police information and criminal-analysis files.
The rules bind several different actors. The General Secretariat, based in Lyon, processes notices, diffusions, and databases. National Central Bureaus — the national contact points in each member country — submit and receive data. Authorised officials within those structures must follow the same standards. In practice, this means a request that originates in one country and travels through INTERPOL’s channels is subject to one shared set of data-protection obligations, regardless of where the underlying investigation sits.
The rules also distinguish between different categories of data. Notices and diffusions are the best-known, but INTERPOL also maintains databases on wanted persons, stolen property, and criminal networks. Each category has its own retention logic and access conditions. The overarching principle is that data must serve a legitimate international police-cooperation purpose and nothing else.
Core Principles Governing the Processing of Data
The rulebook is built on a handful of principles that anyone dealing with an INTERPOL file should understand. They are not abstract ideals; they are the tests that oversight bodies actually apply when a complaint is filed.
Lawfulness and purpose limitation. Data may only be processed for the purposes for which it was provided. A notice issued to locate a fugitive cannot be repurposed as a general intelligence-gathering tool. If the original purpose disappears — for example, charges are dropped — the legal basis for keeping the data weakens considerably.
Quality and accuracy. Information must be accurate, relevant, and up to date. INTERPOL’s rules require that data be corrected or deleted when it is shown to be inaccurate or no longer necessary. This is where many individual complaints begin: a person discovers that a notice still reflects charges that were resolved years ago.
Proportionality. The measure must be appropriate to the seriousness of the underlying offence. A diffusion for a minor matter should not carry the same weight or visibility as a Red Notice for a serious crime.
Retention limits. Data cannot be kept indefinitely without justification. The rules set review periods and require that entries be re-examined so that stale or resolved matters do not linger in the system.
Security and confidentiality. Access is restricted to authorised users, and technical and organisational safeguards must protect against unauthorised disclosure. A leak of notice data can cause serious harm to a person’s reputation and liberty.
One practical point that surprises many people: INTERPOL’s rules prohibit requests that are politically motivated or that violate fundamental human rights. A notice that exists mainly to pressure a dissident or a business rival is not a lawful use of the system, and the rules give individuals a route to challenge it.
Who Supervises Compliance: The CCF and the Control Commission
Rules only matter if someone enforces them. INTERPOL has two independent oversight bodies with distinct mandates, and understanding the difference helps you direct a complaint to the right place.
The Commission for the Control of Files (CCF) handles individual requests. If you believe that data about you in INTERPOL’s files is inaccurate, unlawful, or being kept beyond its permitted retention period, the CCF is the body that can examine your request. It has the power to recommend correction or deletion, and its decisions carry real weight within the organisation. The CCF operates independently of the General Secretariat and of the National Central Bureaus that submitted the data.
The Control Commission for INTERPOL’s Information System takes a broader, systemic view. It examines how the information system as a whole complies with the data-processing rules, including technical and organisational safeguards. Where the CCF looks at your individual file, the Control Commission looks at whether the machinery handling that file meets the required standards.
Both bodies matter because INTERPOL’s structure is decentralised. A notice is usually requested by a member country, not by INTERPOL itself. That means a complaint often has to address both the accuracy of the underlying national request and the way INTERPOL processed it. Legal practitioners who work in this area, including the team at interpol-stop.com, regularly prepare CCF complaints and challenges to diffusions precisely because the procedural path is specific and unforgiving of errors.
How an Individual Can Request Access, Correction, or Deletion
The rules give individuals rights, but they are exercised through a defined procedure rather than a simple customer-service request. The general sequence looks like this.
First, the person establishes what data exists. INTERPOL’s rules provide for access requests, subject to exceptions where disclosure would harm an investigation or the rights of others. The response typically confirms whether data is held and, within limits, what it says.
Second, if the data is wrong or unlawful, the person submits a request for correction or deletion. This is where precision matters. The request must identify the specific entry, explain why it fails the principles described above, and provide supporting evidence — court documents, dismissal orders, identity records, or proof that a matter was resolved.
Third, if the request is not resolved satisfactorily, the matter goes to the CCF. The CCF reviews the file, may seek observations from the relevant National Central Bureau, and issues a decision. Timelines apply, and the process is documentary rather than adversarial in the courtroom sense.
Fourth, in some situations the underlying national decision can also be challenged in the country that requested the notice. This is often the most durable route, because if the national authority withdraws its request, the INTERPOL entry typically falls away with it.
A useful way to picture the structure is set out below.
| Element | What it covers | Who is responsible |
|---|---|---|
| Rules on the Processing of Data | Core principles for all personal data handled through INTERPOL channels | General Secretariat, National Central Bureaus, authorised officials |
| Notices and diffusions | Specific entries on wanted persons, stolen property, and threats | Requesting country, reviewed by INTERPOL |
| CCF | Individual requests for access, correction, or deletion | Independent Commission for the Control of Files |
| Control Commission | System-wide compliance of the information system | Independent oversight body |
| National challenge | The original request made by a member country | Courts and authorities of that country |
One point deserves emphasis: deadlines and retention periods are set by the rules and by the decisions of the oversight bodies, not by informal practice. Anyone relying on a specific time limit should verify it against the current published rules, because they are updated periodically.
Frequently Asked Questions About INTERPOL Data Processing
Can an INTERPOL notice lead to my arrest or detention?
A Red Notice is a request to locate and provisionally arrest a person pending extradition, but it is not itself an international arrest warrant. Whether you are detained depends on the national law of the country you are in and on whether that country treats the notice as a valid basis for action. A diffusion can have similar practical effects. That is why challenging an unlawful notice early — before travel or a border encounter — is often the most effective strategy.
How long does INTERPOL keep data about a person?
There is no single fixed period. Retention depends on the category of data and the purpose it serves. The rules require periodic review and deletion when the data is no longer necessary for the purpose for which it was provided. A resolved criminal matter, for example, should not remain in the system indefinitely without justification.
Who can file a complaint with the CCF?
Any individual who believes that data concerning them is being processed in violation of the rules can submit a request to the Commission for the Control of Files. The request must identify the data and explain the alleged violation. Because the procedure is formal, many people choose to have it prepared by lawyers experienced in INTERPOL matters.
Do the rules apply to National Central Bureaus as well as to INTERPOL itself?
Yes. The Rules on the Processing of Data bind the General Secretariat, the National Central Bureaus, and authorised officials who handle data within the system. This shared obligation is what allows the oversight bodies to examine both the original national request and the way INTERPOL processed it.
Last updated: 28 September 2026.
About the author: The lead lawyer at Interpol-Stop is an international legal practitioner specialising in INTERPOL cases, including Red Notice removal, CCF complaints, and challenges to INTERPOL Diffusions. The firm assists clients in protecting their rights against unlawful or politically motivated use of INTERPOL mechanisms.