Where we work · Albania
ISO and GRC certification consulting in Albania
Achieve ISO and GRC certification in Albania with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Albania
Clients include
ISO and GRC certification in Albania at a glance
Albania replaced its 2008 personal data law with Law No. 124/2024, which states that it is aligned with the EU's GDPR, and the Commissioner for the Right to Information and Protection of Personal Data supervises it. Food businesses answer to the National Food Authority, which lists HACCP-based procedures among the rules operators must follow, medical device suppliers register with the National Agency of Medicines and Medical Devices, and banks and payment institutions follow the Bank of Albania's operational risk regulation on business continuity. The General Directorate of Accreditation (DPA) is the national accreditation service and states its EA MLA recognitions; certificates themselves come from accredited certification bodies. The investment agency AIDA names tourism, textiles and footwear, energy, agriculture, ICT and BPO as strategic sectors. Sterling's Frankfurt office serves Albanian clients, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement. Sterling does not certify; accredited certification bodies do.
ISO and GRC standards Sterling delivers in Albania
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Albania (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law No. 124/2024 "On the protection of personal data" (Ligji nr. 124/2024 "Për mbrojtjen e të dhënave personale") Commissioner for the Right to Information and Protection of Personal Data (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale; the Commissioner, also IDP), the independent authority that monitors and supervises the right to personal data protection under the Law | Applies to automated processing and to personal data in or meant for a filing system, and reaches controllers outside Albania that offer goods or services to, or monitor the behaviour of, people in Albania, who must name a representative in Albania in most cases. Processing follows principles of lawfulness, fairness and transparency, purpose limitation, minimisation, accuracy, storage limitation and security, and needs one of the lawful bases the Law lists (consent, contract, legal duty, vital interests, public task or legitimate interests). Special categories and criminal data have their own conditions. Individuals have rights to information, access, correction, erasure, restriction, portability and objection, and not to be subject to solely automated decisions with legal or similar effects. Controllers must be able to show compliance, apply data protection by design and by default, keep records of processing, use processors only under a written contract, secure processing with measures suited to the risk, and notify the Commissioner of a personal data breach as soon as possible and no later than 72 hours after becoming aware, unless the breach is unlikely to put people's rights at risk. A data protection officer is required for public authorities, for large-scale regular and systematic monitoring and for large-scale processing of special-category or criminal data. Transfers abroad rely on an adequacy decision of the Commissioner or on safeguards such as standard data protection clauses, binding corporate rules, approved codes of conduct or certification mechanisms. Certification under the Law may be granted only by certification bodies accredited by the General Directorate of Accreditation. The Commissioner can impose administrative sanctions and corrective measures. | |
| Previous law: Law No. 9887 of 10.3.2008 "On the protection of personal data", as amended by Laws 48/2012, 120/2014 and 78/2023 Commissioner for the Right to Information and Protection of Personal Data | Useful only to read older documents, notifications and authorisations that cite it: Law 124/2024 treats references to the old law as references to itself where possible, and keeps earlier decisions and authorisations in force so long as they do not conflict with it. | |
| Commissioner's registers and guidance: data protection officers, accredited bodies and certified controllers Commissioner for the Right to Information and Protection of Personal Data | The DPO page restates when a controller or processor must appoint a data protection officer and treats the officer as the channel between the Commissioner and the organisation. The register of certified controllers lists organisations of different kinds by name. | |
| National Food Authority (Autoriteti Kombëtar i Ushqimit, AKU) Food producers, processors, traders and exporters | Law No. 9863 of 28.01.2008 "On food" (as amended) and Instruction No. 20 of 25.11.2010 on the implementation of prerequisite programmes, good hygiene practice, good manufacturing practice and HACCP-based procedures in food establishments, both listed by AKU among the legislation food business operators must follow. AKU states that its mission is to guarantee the safety and quality of food and feed along the chain through inspection, technical and scientific activity; wholesale food activity needs a licence through the National Business Centre, with AKU verifying the conditions on site; and AKU's export manual describes official controls and certification of animal-origin products for export to EU and non-EU countries for establishments holding a CE number. | HACCP, ISO 22000, FSSC 22000 |
| National Agency of Medicines and Medical Devices (Agjencia Kombëtare e Barnave dhe Pajisjeve Mjekësore, AKBPM) Medical device makers, importers and distributors | Law No. 89/2014 "On medical devices" and its sub-legal acts. The agency's Medical Devices Sector assesses applications to enter a device in the national register, applying through a wholesale trading authorisation from the Ministry of Health and Social Protection, and asks for the declaration of conformity and/or CE documentation; it also inspects devices on the market. The agency's mission covers placing on the market, export, trade and use of medicines and medical devices. | ISO 13485 |
| Bank of Albania (Banka e Shqipërisë), Supervision Department and Supervisory Council Banks, payment institutions and electronic money institutions | Regulation "On the operational risk management by banks, payment institutions and electronic money institutions", approved by Supervisory Council Decision No. 51 of 6.11.2024 under the laws on the Bank of Albania, on banks and on payment services (Law No. 55/2020). It requires business continuity plans that are part of operational risk management, and its reporting annexes cover cyber incidents and an annual risk assessment of information security and business continuity. The Bank also publishes Regulation No. 29/2022 on strong customer authentication and common, open and secure communication standards and Regulation No. 14/2023 on payment institutions. | ISO/IEC 27001, ISO 22301, PCI DSS, SOC 2 |
| National Authority for Electronic Certification and Cyber Security (AKCESK), with the National Agency for Information Society (AKSHI) Operators of infrastructure with a major impact on public services; state institutions | AKSHI's website reports a cyber security incident reporting system run by AKCESK and a training course on it for state institutions and for private operators of infrastructure with a major impact on public services, including the electricity distribution and transmission operators, the air navigation provider, the health insurance fund and banks. No ISO standard is named. | ISO/IEC 27001 |
| General Directorate of Standardization (Drejtoria e Përgjithshme e Standardizimit, DPS) Standards (Albanian national standards) | DPS describes standards as voluntary technical documents, reports that it is a correspondent member of ISO, takes part in CEN and CENELEC and is a full member of ETSI, and publishes sections on the ISO 9000, 14000, 17000, 22000 and 45000 series (standards role only). | ISO 9001, ISO 14001, ISO 45001, ISO/IEC 17025, ISO 22000 |
Accreditation and recognition
- General Directorate of Accreditation (DPA; the national accreditation service of the Republic of Albania): National accreditation body — a public authority acting as the national accreditation service under Law No. 116/2014 "On the accreditation of conformity assessment bodies in the Republic of Albania", subordinate to the Ministry of Finance and Economy, working to ISO/IEC 17011; Law 124/2024 gives it the role of accrediting the bodies that certify data protection processing.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under Law No. 162 of 23.12.2020 "On public procurement", as amended by Law 16/2024 (Contracting authorities, with the Public Procurement Agency (Agjencia e Prokurimit Publik) publishing the law in force): Qualification and technical criteria are set in the tender documents of each contracting authority, so a management system certificate is a requirement only where the individual notice asks for one. The Agency publishes the law in force, the Council of Ministers decisions and the standard tender documents.
Economic zones
- Technological and Economic Development Areas (TEDA), promoted by the Albanian Investment Development Agency: manufacturing, automotive, information technology, electronics, biotechnology, tech-logistics
Sterling in Albania
Sterling delivers in Albania from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Albania clients ask
Which personal data law applies in Albania, and who supervises it?
Law No. 124/2024 "On the protection of personal data" applies, and the Commissioner for the Right to Information and Protection of Personal Data supervises it as an independent authority. The Law replaces Law No. 9887/2008 and states that it is aligned with the EU's GDPR and Law Enforcement Directive. Check how particular articles apply to your business with counsel or the Commissioner.
Is Albania's 2008 data protection law still in force?
No. The Commissioner's legislation page lists Law No. 9887/2008 as repealed, and Law 124/2024 itself provides for that repeal. Authorisations granted under the old law carry on only so far as they do not clash with the new text, and mentions of the old law in other legislation now point to the new one. Ask counsel about any older permission you rely on.
Who accredits certification bodies in Albania?
The General Directorate of Accreditation (DPA) is the national accreditation service. It states that it is an EA MLA signatory for testing, inspection and management system certification, and Law 124/2024 gives it the task of accrediting bodies that certify data protection processing. Ask any certification body for its accreditation certificate and read the scope before signing.
Do Albanian food businesses have to apply HACCP?
In practice, yes. AKU, the National Food Authority, names Instruction No. 20 of 25.11.2010 on prerequisite programmes and HACCP-based procedures in the list of rules food operators must follow. That duty concerns the procedures themselves. An outside HACCP or ISO 22000 certificate is a different, optional step requested by buyers. Ask AKU how your category of activity is treated.
Do banks in Albania need business continuity plans?
Banks, payment institutions and electronic money institutions must develop business continuity plans under the Bank of Albania's operational risk regulation (Decision No. 51 of 6.11.2024). The plans form part of operational risk management and cover key activities, disruption scenarios and recovery of electronic system data. The regulation does not require ISO 22301 certification; confirm details with the Bank of Albania.
Which language is used for ISO audits in Albania?
Albanian is the language of the laws and of regulator correspondence, and investor material from the investment agency is also published in English. The audit language is negotiable: settle it, with any interpreter and the language of controlled documents, when you apply to the certification body, and follow any rule in a tender or customer contract.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law No. 124/2024 "On the protection of personal data" (Ligji nr. 124/2024 "Për mbrojtjen e të dhënave personale") — idp.al (accessed 18 Oct 2026)
- Previous law: Law No. 9887 of 10.3.2008 "On the protection of personal data", as amended by Laws 48/2012, 120/2014 and 78/2023 — idp.al (accessed 18 Oct 2026)
- Commissioner's registers and guidance: data protection officers, accredited bodies and certified controllers — idp.al (accessed 18 Oct 2026)
- Law No. 9863 of 28.01.2008 "On food" (as amended) and Instruction No. 20 of 25.11.2010 on the implementation of prerequisite programmes, good hygiene practice, good manufacturing practice and HACCP-based procedures in food establishments, both listed by AKU among the legislation food business operators must follow. AKU states that its mission is to guarantee the safety and quality of food and feed along the chain through inspection, technical and scientific activity; wholesale food activity needs a licence through the National Business Centre, with AKU verifying the conditions on site; and AKU's export manual describes official controls and certification of animal-origin products for export to EU and non-EU countries for establishments holding a CE number. — aku.gov.al (accessed 18 Oct 2026)
- Law No. 89/2014 "On medical devices" and its sub-legal acts. The agency's Medical Devices Sector assesses applications to enter a device in the national register, applying through a wholesale trading authorisation from the Ministry of Health and Social Protection, and asks for the declaration of conformity and/or CE documentation; it also inspects devices on the market. The agency's mission covers placing on the market, export, trade and use of medicines and medical devices. — akbpm.gov.al (accessed 18 Oct 2026)
- Regulation "On the operational risk management by banks, payment institutions and electronic money institutions", approved by Supervisory Council Decision No. 51 of 6.11.2024 under the laws on the Bank of Albania, on banks and on payment services (Law No. 55/2020). It requires business continuity plans that are part of operational risk management, and its reporting annexes cover cyber incidents and an annual risk assessment of information security and business continuity. The Bank also publishes Regulation No. 29/2022 on strong customer authentication and common, open and secure communication standards and Regulation No. 14/2023 on payment institutions. — bankofalbania.org (accessed 18 Oct 2026)
- AKSHI's website reports a cyber security incident reporting system run by AKCESK and a training course on it for state institutions and for private operators of infrastructure with a major impact on public services, including the electricity distribution and transmission operators, the air navigation provider, the health insurance fund and banks. No ISO standard is named. — akshi.gov.al (accessed 18 Oct 2026)
- DPS describes standards as voluntary technical documents, reports that it is a correspondent member of ISO, takes part in CEN and CENELEC and is a full member of ETSI, and publishes sections on the ISO 9000, 14000, 17000, 22000 and 45000 series (standards role only). — dps.gov.al (accessed 18 Oct 2026)
- General Directorate of Accreditation (DPA; the national accreditation service of the Republic of Albania) — dpa.gov.al; idp.al (accessed 18 Oct 2026)
- Public procurement under Law No. 162 of 23.12.2020 "On public procurement", as amended by Law 16/2024 — app.gov.al (accessed 18 Oct 2026)
- Technological and Economic Development Areas (TEDA), promoted by the Albanian Investment Development Agency — aida.gov.al
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice