Procedure for Issuing Export and Import Licenses for Dual-Use Technology Products

In addition to the Business License for cybersecurity products and services, organizations and enterprises, when exporting and importing cybersecurity (CS) products listed in the Catalog of CS Products Subject to Licensing for Export and Import, must also obtain a separate Export and Import License for CS products issued by the Ministry of Public Security.

For dual-use products—those possessing both civil cryptography and cybersecurity features—the authority to issue licenses rests with the Ministry of Public Security. However, the Ministry of Public Security must obtain written opinions from the Government Cipher Committee regarding the civil cryptography features prior to granting the license.

Scope of application

Pursuant to Decree No. 341/2026/NĐ-CP, dual-use products are products that simultaneously possess civil cryptography features and cybersecurity features.

Notes on Dual-Use Products:

The Ministry of Public Security issues the Business License for cybersecurity products and services as well as the Export and Import License for cybersecurity products for dual-use products;
Prior to granting the license, the Ministry of Public Security shall seek written opinions from the Government Cipher Committee regarding the civil cryptography features of the product;
Dual-use products featuring civil cryptography must comply with technical standards and regulations on civil cryptography.

Conditions of application

Meet the conditions for obtaining a Business License for cybersecurity products and services pursuant to Decree No. 332/2026/NĐ-CP;
For import and export activities: meet the conditions for obtaining an Export and Import License for cybersecurity products pursuant to Decree No. 332/2026/NĐ-CP;
Products with civil cryptography features must comply with technical standards and regulations on civil cryptography pursuant to Decree No. 341/2026/NĐ-CP.

Dossier

Carried out in accordance with the dossiers for obtaining a Business License for cybersecurity products and services and an Export and Import License for cybersecurity products pursuant to Decree No. 332/2026/NĐ-CP.

Enterprises shall supplement necessary documents to identify and evaluate the civil cryptography features of the products as required by the licensing authority.

Implementation procedure

Process	Detailed Description
Step 1	The enterprise prepares the dossier requesting the issuance of a Business License for cybersecurity products and services or an Export and Import License for cybersecurity products in accordance with regulations.
Step 2	The Ministry of Public Security receives, inspects, and appraises the dossier pursuant to Decree No. 332/2026/NĐ-CP;
Step 3	Prior to granting the license, the Ministry of Public Security shall obtain written opinions from the Government Cipher Committee regarding the civil cryptography features of the product;
Step 4	Based on the dossier and the opinion of the Government Cipher Committee, the Ministry of Public Security shall consider issuing the license in accordance with regulations.

Notes: The processing time for dual-use products is carried out in accordance with Decree No. 332/2026/NĐ-CP for each type of license; however, the actual processing time may be longer depending on the time it takes for the Government Cipher Committee to respond with opinions regarding civil cryptography features.

Meeting the stringent requirements on technical personnel, physical infrastructure, and the formulation of technical-business plans pursuant to Decree No. 332/2026/NĐ-CP requires enterprises to prepare thoroughly right from the pre-feasibility stage. In particular, the technical classification boundary between specialized cybersecurity products, civil cryptography products, and dual-use products between the Ministry of Public Security and the Government Cipher Committee represents the biggest bottleneck that may cause dossiers to be prolonged or license applications to be refused. Proactively reviewing the equipment portfolio, software features, and standardizing legal dossiers is the prerequisite foundation to help enterprises minimize customs clearance time and maintain a smooth supply chain.

Checklist for Enterprises — Export and Import Licenses for Cybersecurity Products and Dual-Use Products

Step 1. Review and classify export/import products: Cross-check the entire portfolio of equipment and software intended for export/import against the Catalog of Cybersecurity Products Subject to Licensing for Export and Import in Appendix II of Decree No. 332/2026/NĐ-CP, while also checking against Appendices I and II of Decree No. 341/2026/NĐ-CP to determine whether the products simultaneously possess civil cryptography features;

Step 2. Determine features and licensing authorities: Determine whether the product is a specialized cybersecurity product or a dual-use product, thereby identifying the correct competent authority (the Ministry of Public Security or the Government Cipher Committee) and the applicable procedure;

Step 3. Check personnel and facility conditions: Ensure compliance with conditions for obtaining a Business License for cybersecurity/civil cryptography products and services before submitting the application for export and import licenses;

Step 4. Standardize technical dossiers: Prepare documents describing the product, functions, purpose of use, technical specifications, and documents proving the purpose and target recipients of export/import, ensuring consistency between legal and technical dossiers;

Step 5. Monitor shipment quantities and license validity: Establish an internal mechanism to track the quantity of licensed shipments, the quantities actually exported/imported, and the validity period of the export and import licenses, which are valid for 02 years for cybersecurity products and 03 years for civil cryptography products, to ensure continuous compliance.

Note: Correctly classifying whether a product is a specialized cybersecurity product or a dual-use product determines whether the dossier must include supplementary documents identifying civil cryptography features, and directly affects the actual processing time due to the need to obtain opinions from the Government Cipher Committee.

COMMITMENT TO SERVICES

On time

All that we do will be planned specifically in terms of time and content. You can control what we do, and the time to completion, and in all cases, we help you maintain the enterprise’s compliance with the deadlines with competent authorities and employees.

Exactly

We commit to the accuracy of the contents of consultation, established documents, and services we provide to customers. We aim to provide you with a safe and effective legal solution for your business operations.

Security

We establish a confidentiality commitment with you, so information about the enterprise, human resources, finance, etc., and other contents related to enterprises and investors will only be disclosed with your consent or in accordance with the laws of Vietnam.

SERVICE PERFORMANCE PROCESS

Assign

CDLAF assigns designated personnel responsible for ensuring information security, ensuring that only assigned individuals have the right to access information and handle client communication.

Collect information and prepare the service contents

Assigned personnel are responsible for collecting clients information, reviewing regulations and preparing service content.

Control the quality

The Board of Lawyers and Counsels reviews the service content prepared by the assigned personnel before it is sent to clients for their review.

Clients’ approval

Clients review and approve the service content prepared by CDLAF. When requested, meetings are held to explain the prepared content.

Completion

Personnel responsible for service completion directly implement it at the competent authority (if required). They also monitor the progress, report the results, and hand them over to clients.

After-service support

Guide clients to perform necessary tasks related to the delivered results and provide updates on changes in legal regulations.

People

Contact Us

Are you confused? If you want to discuss your problem more specifically, let us help you, please fill in the information in the table below and send it to us. A free 45-minute consultation email or meeting will be arranged to help you better understand your problem solving problem.

FAQ QUESTIONS: Procedure for Issuing Export and Import Licenses for Dual-Use Technology Products

What are “civil cryptographic products” and “civil cryptographic services”?

Civil cryptographic products: These are hardware, software, documents, technical equipment, and cryptographic professional equipment designed and manufactured to protect information.

Civil cryptographic services: These comprise information protection services using civil cryptographic products; civil cryptographic product assessment services; and security and cybersecurity consulting services using civil cryptographic products.

Must foreign enterprises providing services in Viet Nam store data in Viet Nam?

Yes. The law provides that domestic and foreign enterprises providing services on telecommunications networks, the Internet, and value-added services in cyberspace in Viet Nam, if they engage in the collection, exploitation, analsys, or processing of the categories of data within the scope prescribed by the Law, may be required to store such data in Viet Nam for a period prescribed by the Government.

Is the provision of cybersecurity inspection and assessment service a conditional business line?

Yes. The Law lists “cybersecurity inspection and assessment services” within the group of cybersecurity services. In addition, there are other services such as information security using civil cryptography, civil cryptography, cybersecurity consulting, cybersecurity monitoring, incident response, data recover, cyberattack prevention and combat, and other cybersecurity services.

According to Article 29, enterprises trading in cyber security products and services must have a license to trade in cyber security products and services, and at the same time must meet the responsibilities of maintaining business conditions, service quality, confidentiality of customer information, managing records and coordinating with specialized forces when required.

Why are civil cryptographic products required to be inspected, certified and declared conformity before commercial circulation?

Mandatory requirements: Civil cryptography products must be inspected and certified for conformity before being circulated on the market to ensure the quality of cryptography meets standards

Management mechanism: The Government Cipher Committee is responsible for managing the quality of civil cryptography products and services through the appointment and management of activities of civil cryptography conformity assessment and certification organizations

This helps protect end users from products that contain dangerous encryption vulnerabilities or are installed with spyware and protect national security in cyberspace.

What are the necessary and sufficient conditions for an enterprise to be granted a license to export and import civil cryptographic products?

According to Article 10, Clause 1, the enterprise must fully meet the following 03 mandatory conditions:

Having a valid license to trade in corresponding civil cryptographic products and services.
Imported civil cryptographic products must be certified and declared technical-regulation conformity according to Vietnamese technical standards.
The objects to which the products are transferred and the purpose of using these civil cryptographic products do not harm national defense and security and social order and safety.