DOCS

PII requirements for customs entries

Why U.S. and EU customs authorities require shipper and recipient PII for postal shipments.

Overview 

Customs authorities in the U.S. and EU require personally identifiable information (PII) for the shipper and recipient of every shipment. PII is any data that identifies a person. For customs entries, that means name and address, which customs law requires, and shipper email and phone, which the clearance process requires. These requirements come from customs law and the clearance process, not from Zonos.

Zonos files customs entries for postal operators. To file an entry that customs will accept, Zonos must include the PII that customs requires. Zonos only uses it to prepare and file customs entries, resolve customs holds, and keep required records. Zonos does not sell PII, use it for marketing, or use it to train AI models.

The U.S. and EU require the same core PII, so one data-sharing setup covers both.

U.S. requirements 

The U.S. no longer exempts low-value mail from duty, so every U.S.-bound postal shipment needs a customs entry. Starting October 22, 2026, virtually all postal shipments must be filed as entries in CBP's Automated Commercial Environment (ACE). CBP requires the shipper's and recipient's name and address on each entry. Shipper email and phone are required by the clearance process, because CBP directs questions to the broker and only the shipper can answer them (see note 1).

EU requirements 

The EU requires the same shipper and recipient PII for safety and security screening and for the customs declaration. Postal items are no longer exempt.

  • ICS2 — The EU's Import Control System 2 requires advance data for all goods entering the EU, including postal items. If the recipient has no EORI number, their full name and address are required (Irish Revenue, ICS2 Release 3). Learn more in the Zonos ICS2 guide.
  • H7 declaration — Low-value goods are declared on a reduced dataset that includes consignor and consignee details (European Commission).
  • €150 exemption ended — As of July 1, 2026, parcels worth up to €150 are subject to a temporary €3 customs duty (European Commission).

GDPR — Customs law requires this PII, so processing it is lawful under GDPR Article 6(1)(c), which covers processing needed to meet a legal obligation. For EU-origin shipments, this includes the shipper's data.

PII required by customs 

The table shows what U.S. and EU customs authorities require or request on each entry.

Data element↕Purpose↕U.S.↕EU↕
Shipper nameIdentifies the shipper on the entryRequiredRequired
Shipper addressIdentifies the shipper and supports screeningRequiredRequired
Shipper email or phoneResolves customs holds and document requestsNeeded for clearance (note 1)Requested (note 2)
Recipient nameIdentifies the consignee on the entryRequiredRequired
Recipient addressIdentifies the consignee and delivery destinationRequiredRequired
Recipient email or phoneContacts the consignee about duties or holdsRequested (note 3)Requested (note 2)
Note 1: Why shipper contact details are needed for U.S. entries
Note 2: Why contact details are requested for EU entries
Note 3: Why recipient contact details are requested for U.S. entries

Sharing PII with Zonos 

Use your existing integration. No new data-sharing agreement is needed for IPC or UPU posts.

  • IPC and UPU — Update to the consignment API. Your existing data-sharing agreement already covers these fields.
  • CSV — Add shipper and recipient email and phone columns to your file.
  • Verified Accounts — If you send a Declaration ID and the shipper has a Zonos account, Zonos uses the contact details on that account.

Where PII goes 

Zonos only shares PII with the authorities that require it.

  • Customs authorities — CBP in the U.S., or the customs authority of the EU member state of entry.
  • Partner government agencies — Agencies such as the FDA or USDA, when a shipment falls under their rules.

How Zonos protects PII 

Zonos handles PII under the controls in its Privacy Policy and Trust Center.

  • Security — Zonos encrypts PII at rest and in transit. Access follows least privilege, uses role-based controls, needs multi-factor authentication (MFA) for admin access to production, and is reviewed every quarter. Zonos holds SOC 2 Type 2 and PCI DSS v4.0.1 attestations, has an independent penetration test every year, and is certified under the EU–U.S. Data Privacy Framework.
  • Retention — Zonos keeps entry records only as long as customs law requires: generally five years in the U.S. (19 CFR 163.4) and at least three years in the EU (Union Customs Code, Article 51).
  • No sale or marketing — Zonos does not sell PII or use it for marketing.
  • No AI training — Zonos does not use PII to train its models. Learn more about how Zonos approaches AI training.

Missing PII 

Without the PII customs requires, the entry is incomplete and the shipment can't clear.

  • Missing name or address — Customs rejects the entry. The shipment may be held, returned, or refused.
  • Missing email or phone — If customs holds the shipment, no one can be reached to resolve it.

CBP requires brokers to exercise responsible supervision and control, which includes knowing the shipper and being able to reach them. Posts can provide these details directly to Zonos, or Zonos can collect this information through Verified Accounts and the Zonos app.

Questions 

Contact support@zonos.com or your Zonos account manager.

Book a demo

Was this page helpful?


Get support·Legal docs·© 2026 Zonos