Tiếng Việt
中文 (中国)
IMPORT PROCEDURE GUIDE FOR DLP
DLP (Data Loss Prevention) refers to information security products used to detect, monitor, control or prevent sensitive data leakage through endpoints, networks, email, storage or cloud environments. For physical DLP appliances, the customs risk does not come from the commercial name “DLP” alone, but from the technical nature of the goods: an automatic data processing machine, an ADP system, a network device for transmitting/receiving data, or merely software/license. If the commercial documents are too generic, the model does not match the catalogue, hardware and license are not separated, or encryption/security functions are not declared correctly, the shipment may be required to explain HS classification, review information security/civil cryptography licensing, supplement specialized dossiers, lose C/O preferential treatment or incur DEM/DET before clearance. This article provides an E2E (End-to-End) review map before ETA, covering HS code, duties, specialized policies, dossier, clearance workflow and risk checkpoints.
SCOPE OF APPLICATION
This article applies only to DLP products used to monitor data flows, detect sensitive data, enforce blocking/labeling/encryption/alert policies and control outbound data movement within enterprise systems.
- It does not automatically apply to vulnerability scanners, database security, storage security or other data protection products, even if they are listed in the same menu group.
- It does not automatically apply to online software downloads, electronic licenses, subscriptions or SaaS DLP services without physical goods.
- It does not automatically apply to firewall, UTM, SIEM, NAC or network monitoring products if their main function is not data loss prevention.
- New, used, refurbished, sample, warranty replacement or project cargo may be subject to different policies.
- If the device includes Wi‑Fi/Bluetooth/4G/5G modules, encryption, key management, VPN/tunnel, battery, adapter or accessories, each policy layer must be reviewed separately.
Review must be based on the actual catalogue, datasheet, model and import purpose.
CLASSIFICATION & TECHNICAL IDENTIFICATION
A DLP product may be a standalone appliance, an automatic data processing machine, a data inspection gateway, a network device with DLP policies or hardware bundled with licenses. CPU, memory, OS, network ports, storage, license and deployment mode should be identified.
The main function should show data discovery, content inspection, policy enforcement, endpoint/network/email/storage DLP, data classification, blocking/quarantine or audit trail. If the product mainly performs firewall, SIEM or storage functions, HS and policy treatment may differ.
Catalogue, datasheet, user manual, model list, label images, deployment diagram, port specifications, radio modules and license description are the minimum documents for pre-ETA review.
| Checkpoint | Documents to compare | Risk if incorrectly described | Suggested goods description |
|---|---|---|---|
| Physical device or software/license | Invoice, PO, packing list, license terms, datasheet | Incorrect HS, customs value and tax treatment | Data Loss Prevention appliance, model…, with operating license if any |
| Main function as DLP | Catalogue, user manual, feature list, policy engine description | May be reclassified as firewall, SIEM, storage appliance or general network equipment | Data Loss Prevention appliance used for data leakage control |
| Hardware configuration and ports | Datasheet, port photos, BoM if any | Insufficient basis to distinguish heading 8471 from 8517 | State CPU/RAM/storage, Ethernet/SFP ports, power supply and accessories |
| Encryption/key management | Security admin guide, encryption specification | Possible civil cryptography review | Clarify whether encryption is a data protection feature or an independent cryptographic function |
| Goods condition | Invoice, condition statement, serial/year, photos | Risk relating to used/refurbished ICT goods | State new 100%, refurbished, warranty replacement or sample |
HS CODE – DUTIES – C/O
DLP should not be classified only by its commercial name. The key factors are principal function, structure, operating principle, standalone capability and whether the device mainly processes data automatically or transmits/receives data over a network. Under the information security import licensing list, Data Loss Prevention (DLP) products should be reviewed under the HS directions: 8471.30.90, 8471.41.90, 8471.49.90 and 8517.62.43.
REFERENCE TAX TABLE
| Reference HS | Indicative application | Ordinary duty | MFN duty | VAT | Special preferential duty with valid C/O | Note |
|---|---|---|---|---|---|---|
| 8471.30.90 | DLP in the form of a portable ADP machine or device meeting this subheading | 5% | 0% | 10% | Usually 0% if C/O is valid and origin criteria are met | Use only when the goods are technically ADP |
| 8471.41.90 | DLP as an ADP machine in one housing with CPU and input/output units | 5% | 0% | 10% | Usually 0% with valid C/O | Compare CPU, RAM, storage and I/O configuration |
| 8471.49.90 | DLP as an ADP system consisting of multiple functional units | 5% | 0% | 10% | Usually 0% with valid C/O | Suitable when documents show an ADP system |
| 8517.62.43 | DLP appliance operating as equipment for transmitting/receiving data and controlling data flows over a network | 5% | 0% | 10% | Usually 0% with valid C/O | Compare network ports, data transmission and switching functions |
HS REVIEW MATRIX
| Reference HS | Application condition | Risk if misapplied | Documents to verify |
|---|---|---|---|
| 8471.30.90 | The device meets the nature of a portable ADP machine | May be rejected if the goods are actually a rack-mounted network appliance | Catalogue, datasheet, photos, dimensions/weight, CPU/RAM/storage |
| 8471.41.90 | The device has at least CPU, input and output units in one housing | Incorrect if the device is mainly a data transmission gateway | System configuration, user manual, OS specifications |
| 8471.49.90 | The goods form an ADP system with multiple functional units | Incorrect if it is a standalone network transmission/receiving device under heading 8517 | Parts list, system configuration, installation photos |
| 8517.62.43 | Network device transmitting/receiving/converting data and enforcing DLP policies over networks | Incorrect if the principal nature is an independent server/ADP machine | Network port datasheet, topology, throughput and port list |
SPECIALIZED POLICY MATRIX
| Goods scenario | Possible policy | Dossier to check | Authority/portal if identifiable | Recommended timing | Risk note |
|---|---|---|---|---|---|
| Complete DLP appliance | Review import licensing list for information security products | Catalogue, datasheet, DLP function description, model list | Authority of Information Security – Ministry of Information and Communications under Consolidated Document 13/VBHN-BTTTT; current authority/portal should be reviewed under prevailing allocation | Before ETA, preferably from PO stage | Do not conclude no license is needed without model/function review |
| DLP with encryption/key management | Review civil cryptography policy | Crypto specification, admin guide, security feature list | Civil cryptography authority under applicable regulations | Before purchase confirmation | Data encryption may trigger a separate policy layer |
| DLP with Wi‑Fi/Bluetooth/4G/5G | Review ICT/telecom conformity and radio policy | Module datasheet, test report, applicable QCVN if any | Specialized portal/NSW if applicable | Before ETA | Do not treat wireless and wired DLP appliances the same |
| Used/refurbished goods | Review used ICT goods import restrictions and exceptions | Condition statement, serial/year, photos, import purpose | Ministry of Science and Technology / specialized portal if needed | Before purchase | Do not import used goods without a policy basis |
| Sample/warranty/project/EPE/FDI | May involve special declaration, exemption, temporary import or project management | Contract, import purpose, project file, EPE/FDI records | Customs and relevant specialized authorities | Before ETA | Standard trading dossiers may not be sufficient for project cargo |
LEGAL DOCUMENTS TO REVIEW
| Document group | Document name/number | Issuing authority | Effective timing | Role | Key appendix/article | Review note |
|---|---|---|---|---|---|---|
| Law | Law on Cyberinformation Security No. 86/2015/QH13 | National Assembly | Subject to validity review | Legal basis for information security products/services | Rules on trading, export and import of information security products | Compare when determining licensing requirements |
| Circular/consolidated text | Consolidated Document 13/VBHN-BTTTT 2022 | Ministry of Information and Communications | Issued on 28/10/2022 | List of information security products imported under license and licensing dossier | Appendix I – Data Loss Prevention (DLP) | Core reference for DLP policy |
| Decree | Decree 26/2023/ND-CP | Government | Effective 15/07/2023 | Preferential import tariff schedule | Relevant HS lines under 8471/8517 | Tax schedule must be checked on the declaration date |
| Circular | Circular 29/2025/TT-BKHCN | Ministry of Science and Technology | Effective 31/12/2025 | List of potentially unsafe ICT/telecom goods | Appendix I/II if the model has applicable modules | Apply only when the actual model falls within scope |
| Circular | Circular 26/2025/TT-BKHCN | Ministry of Science and Technology | Effective 31/10/2025 | Management of used ICT goods subject to import prohibition and exceptions | Import permission dossier for special cases | Critical for used/refurbished products |
| Decree | Decree 211/2025/ND-CP | Government | Effective 09/09/2025 | Civil cryptography activities | Lists/conditions for civil cryptography products if any | Only applies when the model has civil cryptography functions |
| Decree | Decree 43/2017/ND-CP and Decree 111/2021/ND-CP | Government | Check validity | Goods labeling | Original label, Vietnamese sub-label, compulsory contents | Review before circulation in Vietnam |
VIEW / DOWNLOAD ORIGINAL DOCUMENTS
Enterprises should search documents by number on the legal document portal, the Government portal or the issuing authority’s website. Enterprises should also cross-check on the legal document portal or the issuing authority’s website before application.
CUSTOMS CLEARANCE DOSSIER
Commercial Invoice, Packing List, Bill of Lading/Air Waybill, Sales Contract/Purchase Order if any, C/O for preferential duty, catalogue/datasheet, product photos, original label and model/serial list if needed.
Information security import license, civil cryptography license if applicable, quality inspection/conformity documents for ICT modules, test report, labeling dossier, technical documents and used ICT goods dossier if applicable.
Dossier consistency rule: Goods name, quantity, model, serial number, origin and technical specifications must match across commercial documents, catalogue, label, specialized dossier and customs declaration.
| Dossier group | Required documents | Used for | Usually prepared by | Common error | Pre-ETA check |
|---|---|---|---|---|---|
| Commercial | Invoice, Packing List, Contract/PO | Customs declaration, customs value, quantity | Importer, shipper, purchasing | Generic description such as “security device” or “DLP software” | Compare model, description, unit price and Incoterms |
| Transport | B/L or AWB, pre-alert | D/O, declaration, ETA monitoring | Forwarder, agent, shipper | Wrong consignee, packages or weight | Lock transport documents before arrival |
| Technical | Catalogue, datasheet, user manual, deployment diagram, model/serial list | HS and policy review | Supplier, importer, IT/security team | DLP function and license not clearly described | Request English technical documents showing functions, configuration and ports |
| Origin | C/O and through B/L if needed | Preferential duty claim | Shipper, exporter, importer | C/O with wrong HS, description or origin criterion | Compare C/O with invoice, packing list and draft declaration |
| Specialized | ATTT/MMDS license, test report, conformity documents if any | Clearance and market circulation | Importer, compliance, consultant | Prepared after ETA or missing technical description | Review from PO stage and prepare before ETA |
CLEARANCE DECISION POINTS
| Decision point | Question to answer | Evidence | Consequence if unclear | Recommended action |
|---|---|---|---|---|
| HS code | Is the device an ADP machine, ADP system or data transmission/receiving equipment? | Datasheet, manual, port photos | Documentary inspection, explanation request, possible tax reassessment | Prepare HS rationale before ETA |
| Information security | Is the model a DLP product imported under the information security licensing list? | Feature list, catalogue, DLP function description | License or supplementary dossier may be requested | Review licensing list and prepare license dossier if applicable |
| Civil cryptography | Does it have encryption, key management, VPN/tunnel or independent cryptographic functions? | Security admin guide, crypto specification | Civil cryptography policy may apply | Do not conclude exemption without complete technical documents |
| Model and label | Do models on documents match catalogue and labels? | Invoice, packing list, label photo, serial list | Physical inspection or document amendment may be required | Lock model list and label photos before shipment |
| Goods condition | Is it new, used or refurbished? | Invoice, condition statement, photos, serial/year | Import prohibition or special approval risk | Do not import used/refurbished goods before policy review |
PRACTICAL E2E WORKFLOW
Finalize HS, duties, C/O, labeling, goods condition and whether information security, civil cryptography or ICT conformity procedures are required.
Lock Invoice, Packing List, B/L/AWB, catalogue, datasheet, model list and serial list; verify the DLP function.
Prepare information security license, civil cryptography, ICT conformity or used goods dossier if the actual model is in scope.
Green, Yellow or Red channel must be handled with HS, value, C/O and policy explanations ready.
Deliver goods, complete sub-label/conformity marking if applicable, archive shipment records and prepare for post-clearance audit.
Handover import documents, license, tax records, C/O and technical documents to the IT/security/project team.
PRE-ETA RISK CHECKLIST
| Risk | Consequence | Pre-ETA prevention | Documents to check |
|---|---|---|---|
| Incorrect C/O form, HS or description | Preferential duty may be refused | Review draft C/O before issuance | C/O, invoice, packing list, B/L |
| Model mismatch | Long explanation, possible physical inspection | Lock model list and label photos | Invoice, label photo, catalogue |
| Missing security/cryptography dossier | Specialized clearance delay | Review feature list at PO stage | Datasheet, security guide, license if any |
| Generic goods description | Wrong HS, policy and labeling | Describe goods with main function and model | Invoice, packing list, draft declaration |
| Unclear new/used condition | Used ICT goods restrictions | Require supplier’s condition confirmation | Condition statement, serial/year, invoice |
| Hardware and license not separated | Incorrect customs value or description | Separate hardware, license, subscription and service | PO, invoice, license agreement |
FAQ
It may require review as an information security product if it is a complete physical product under the DLP category. The model and technical documents must be checked.
No. The device may be ADP equipment, an ADP system or data transmission/receiving equipment. The commercial name DLP is not sufficient for HS classification.
If MFN duty is already 0%, C/O may not reduce import duty further, but it remains important for origin records, trade terms and FTA-specific conditions.
If it is only license/download without physical goods, it should be separated from goods import and reviewed under software/service contract and withholding tax if applicable.
Imported goods for circulation in Vietnam should be reviewed for original label and Vietnamese sub-label requirements. Details depend on status and import purpose.
Request supplier confirmation or document amendment before ETA. Do not open declaration when model consistency is not controlled.
NEED TO REVIEW IMPORT PROCEDURES OR A SHIPPING PLAN?
Send us the product name, shipping route, current dossier, or implementation request in advance so we can suggest a suitable approach that is practical, focused, and aligned with your shipment.
Cargo Damage at a Port or Warehouse: An Immediate Response Checklist
What Is General Average? How Cargo Interests Should Respond to a GA Notice
When should businesses photograph or video container stuffing and opening?
When Can Cargo Insurers Reject or Reduce a Claim?
Risks of Failing to Inspect a Container Before Cargo Stuffing
Risks of Failing to Inspect a Container Before Cargo Stuffing
What Documents Are Required for a Cargo Insurance Claim?
What Information Should a Cargo Damage Survey Record Contain?
Total Loss vs Partial Loss in Cargo Insurance: What Is the Difference?
Cargo Dented, Wet or Missing Packages: What Should a Business Do?
Who Must Arrange Insurance under CIF and CIP?
Export Process: From Purchase Order to Final Document Set
How Is Cargo Insurance Value Determined?
How Do ICC-A, ICC-B and ICC-C Cargo Insurance Conditions Differ?
When Should a Business Buy Separate Cargo Insurance?