Where we work · Andorra
ISO and GRC certification consulting in Andorra
Achieve ISO and GRC certification in Andorra with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Enschede office team
- Effivity and Academy included
Sectors that ask for certification in Andorra
Clients include
ISO and GRC certification in Andorra at a glance
Andorra's compliance market is shaped by a small set of authorities with wide reach. The Andorran Data Protection Agency (APDA) supervises Qualified Act 29/2021, which also reaches organisations outside the country that process data with means located in Andorra. The National Cybersecurity Agency (ANC-AD), with CSIRT-AD and, for financial entities, the Autoritat Financera Andorrana, applies Law 22/2022 to essential and important entities in energy, transport, banking, health, water, digital infrastructure and food. The Ministry of Health's food safety service inspects food businesses against HACCP-based procedures and issues official health certificates for exports. No Andorran accreditation body appears in the European co-operation for Accreditation directory, so certificates normally come from certification bodies accredited in another economy within the international arrangements, never from Sterling. Hospitality, retail, finance, construction and food production generate most enquiries, and Catalan is the State's official language. Sterling serves Andorran clients from its Enschede office, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Andorra
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Andorra (9)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals (Qualified Act 29/2021 on personal data protection), as amended by Llei 12/2024, del 15 de juliol Agència Andorrana de Protecció de Dades (APDA, the Andorran Data Protection Agency) — a public body with its own legal personality, independent of the public administrations, created in 2005 | The Act applies to any processing of personal data by public or private controllers and processors domiciled in Andorra or constituted under Andorran law, and to those outside Andorra that use processing means located in Andorra, which must appoint a representative established in the country. It sets principles, information duties, data subject rights, controller and processor duties, data protection officers for the cases it lists, breach notification to the APDA, and rules for international transfers. The APDA refers to the GDPR as an interpretive reference only, with the Andorran rules applying directly and in priority. | |
| Commission Decision 2010/625/EU of 19 October 2010 on the adequate protection of personal data in Andorra, and Convention 108+ European Commission (adequacy decision); the APDA applies the transfer rules of Articles 42 to 45 of the Act | The Act's preamble records that the Commission decided in 2010 that Andorra ensures an adequate level of protection of personal data. Article 43 of the Act treats transfers to EU member states as adequate and bases other adequacy on the EU's published list or effective adherence to Convention 108+; otherwise Article 44 requires appropriate safeguards. | |
| Agència Nacional de Ciberseguretat d'Andorra (ANC-AD, the national competent authority and single point of contact), the Autoritat Financera Andorrana (AFA) for financial-sector entities, and CSIRT-AD, the national incident response team Essential and important entities in energy, transport, banking, financial market infrastructure, health, drinking, waste and surface water, digital infrastructure and public administration, and important entities in postal services, waste management, chemicals, food and digital services | Llei 22/2022, del 9 de juny, de mesures per a la seguretat de les xarxes i dels sistemes d'informació (Law 22/2022 on measures for the security of networks and information systems). The Law requires essential and important entities to adopt technical and organisational measures from a risk-management process, to notify significant incidents to CSIRT-AD without delay, to designate an information security delegate, and to send their competent authority a statement of applicability of security measures. Article 12 points to measures under the National Security Scheme (Esquema Nacional de Seguretat), which other internationally recognised standards may complement; Article 20 lets competent authorities require certification of ICT products, services and processes under a cybersecurity certification scheme adopted by regulation. The Law text does not name ISO/IEC 27001. | |
| Autoritat Financera Andorrana (AFA) Financial entities (banks, investment firms, payment and electronic money entities, insurers and intermediaries, and digital asset participants) | The AFA supervises these entities and, under Article 6 of Law 22/2022, is the competent authority for cybersecurity in financial-sector networks and systems, in coordination with the ANC-AD. An AFA press release records a memorandum of understanding between the AFA and the ANC-AD on information exchange, incident handling, crisis coordination, joint exercises and operational resilience for supervised entities within the scope of the Law. The release names no ISO standard. | |
| Servei de Seguretat Alimentària (food safety service), Ministry of Health Food businesses and food exports | The Government's food safety pages say the service carries out surveillance and official control of food establishments, inspecting premises, processes, handler hygiene and training, pest control plans and, where appropriate, sampling, and that it issues official health certificates for the export of foods. They state that Article 5 of the hygiene regulation requires food business operators to create, apply and maintain permanent procedures based on HACCP principles, and they publish a generic good hygiene practice guide and a list of Andorran establishments authorised under EU rules. The pages do not require a HACCP or ISO 22000 certificate. | HACCP |
| Government of Andorra (Ministry of Presidency, Economy, Labour and Housing, as its normative page shows) Occupational health and safety, including construction | The Government's occupational safety and health page lists the regulations in force, among them the regulation on safety and health protection in construction works (BOPA 69, 9 December 2010), the regulation on work equipment, the regulation on occupational health services and the 2018 regulation on the control of preventive activity in companies with their own prevention service. The page does not mention ISO 45001. | |
| Government of Andorra (industrial safety and quality, as its normative page shows) Industrial safety and quality, including lifts, pressure equipment, gas, fire safety and ski installations | The Government's industrial safety page lists the Law on Industrial Safety and Quality and regulations for lifting appliances and lifts, pressure equipment, gas and hydrocarbon installations, fire safety in public premises and in housing and office buildings, ski installations and pistes, explosives, electrical installations, the technical inspection of vehicles and the metrological control of certain measuring instruments. The page names no ISO standard. | |
| Government of Andorra (as the Government's circular economy and energy pages show) Environment, energy and circular economy | Llei 25/2022, del 30 de juny, d'economia circular (circular economy law), with decrees on single-use plastics and food waste prevention; Llei 21/2018, del 13 de setembre, d'impuls de la transició energètica i del canvi climàtic; and Llei 21/2013, del 10 d'octubre, for the rehabilitation of buildings, energy efficiency and renewables. The Government pages do not name ISO 14001 or ISO 50001. | |
| Ministry of Tourism and Commerce (Ministeri de Turisme i Comerç) Tourist accommodation | The Ministry's accommodation page sets out the registration procedure and the rules for each accommodation group, the tourist accommodation occupancy register (ROAT) and the tourist tax. The page names no ISO standard. |
Accreditation and recognition
- Accreditation of certification bodies that serve Andorra: The EA directory of members and MLA signatories lists no Andorran accreditation body, so certificates for Andorran organisations normally come from certification bodies accredited in another economy within the international mutual recognition arrangements.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement (contractació pública) under the Llei de contractació pública (LCP) and the public-sector procurement platform (Ministry of Finance and the contracting authorities): The Government's procurement page publishes instructions, model documents and general administrative and technical clause documents for works, supply and service contracts, among them Instruction 1/2026. The page names no ISO standard, so whether a tender asks for certificates depends on each tender's documents.
Sterling in Andorra
Sterling delivers in Andorra from its Enschede office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Andorra clients ask
Which law protects personal data in Andorra, and who supervises it?
Qualified Act 29/2021 of 28 October on personal data protection, as amended by Act 12/2024, is the governing law, and the Andorran Data Protection Agency (APDA) supervises it. The APDA is an independent public body created in 2005. The Act also reaches organisations outside Andorra that use processing means located there, which must appoint a representative in the country. Confirm your position with counsel or the APDA.
Who enforces cybersecurity duties for Andorran organisations?
Law 22/2022 gives the National Cybersecurity Agency (ANC-AD) the lead, with the financial authority AFA competent for financial-sector systems in coordination with it. Essential and important entities must manage risk, name an information security delegate and report significant incidents to the national response team, CSIRT-AD. Which category an entity falls into is for the authorities to determine, so ask them.
Does Andorra have a national accreditation body for certification bodies?
The European co-operation for Accreditation directory lists none, so Andorran organisations usually hold certificates from certification bodies accredited elsewhere within the international arrangements. Check the body's accreditation certificate and scope for your standard and sector, and ask your customer or regulator which accreditation it accepts before you appoint anyone.
Are certification audits in Andorra conducted in Catalan, Spanish, French or English?
The language is settled with the certification body at application. Catalan is the State's official language, and staff interviews or supplier records may also run in Spanish, French or English. Say early which language the audit and the controlled documents will use, and follow any language that a contract or a regulator's procedure fixes.
Do food businesses in Andorra need a HACCP certificate?
Not according to the Government's food safety pages, which ask for HACCP-based procedures rather than a certificate. They say Article 5 of the hygiene regulation requires operators to create, apply and maintain permanent procedures on HACCP principles, and that the food safety service inspects establishments. A customer may still ask for certification, so check with each buyer.
Do Andorran public tenders require ISO certificates?
Not as a general rule on the Government's procurement page, which publishes instructions, model documents and clause documents without naming an ISO standard. Each tender sets its own qualification criteria in the tender documents, so read them for certificate requirements. For the legal position on a particular procedure, check with the contracting authority or your counsel.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals (Qualified Act 29/2021 on personal data protection), as amended by Llei 12/2024, del 15 de juliol — apda.ad (accessed 18 Oct 2026)
- Commission Decision 2010/625/EU of 19 October 2010 on the adequate protection of personal data in Andorra, and Convention 108+ — eur-lex.europa.eu; apda.ad (accessed 18 Oct 2026)
- Llei 22/2022, del 9 de juny, de mesures per a la seguretat de les xarxes i dels sistemes d'informació (Law 22/2022 on measures for the security of networks and information systems). The Law requires essential and important entities to adopt technical and organisational measures from a risk-management process, to notify significant incidents to CSIRT-AD without delay, to designate an information security delegate, and to send their competent authority a statement of applicability of security measures. Article 12 points to measures under the National Security Scheme (Esquema Nacional de Seguretat), which other internationally recognised standards may complement; Article 20 lets competent authorities require certification of ICT products, services and processes under a cybersecurity certification scheme adopted by regulation. The Law text does not name ISO/IEC 27001. — consellgeneral.ad; govern.ad (accessed 18 Oct 2026)
- The AFA supervises these entities and, under Article 6 of Law 22/2022, is the competent authority for cybersecurity in financial-sector networks and systems, in coordination with the ANC-AD. An AFA press release records a memorandum of understanding between the AFA and the ANC-AD on information exchange, incident handling, crisis coordination, joint exercises and operational resilience for supervised entities within the scope of the Law. The release names no ISO standard. — afa.ad (accessed 18 Oct 2026)
- The Government's food safety pages say the service carries out surveillance and official control of food establishments, inspecting premises, processes, handler hygiene and training, pest control plans and, where appropriate, sampling, and that it issues official health certificates for the export of foods. They state that Article 5 of the hygiene regulation requires food business operators to create, apply and maintain permanent procedures based on HACCP principles, and they publish a generic good hygiene practice guide and a list of Andorran establishments authorised under EU rules. The pages do not require a HACCP or ISO 22000 certificate. — govern.ad (accessed 18 Oct 2026)
- The Government's occupational safety and health page lists the regulations in force, among them the regulation on safety and health protection in construction works (BOPA 69, 9 December 2010), the regulation on work equipment, the regulation on occupational health services and the 2018 regulation on the control of preventive activity in companies with their own prevention service. The page does not mention ISO 45001. — govern.ad (accessed 18 Oct 2026)
- The Government's industrial safety page lists the Law on Industrial Safety and Quality and regulations for lifting appliances and lifts, pressure equipment, gas and hydrocarbon installations, fire safety in public premises and in housing and office buildings, ski installations and pistes, explosives, electrical installations, the technical inspection of vehicles and the metrological control of certain measuring instruments. The page names no ISO standard. — govern.ad (accessed 18 Oct 2026)
- Llei 25/2022, del 30 de juny, d'economia circular (circular economy law), with decrees on single-use plastics and food waste prevention; Llei 21/2018, del 13 de setembre, d'impuls de la transició energètica i del canvi climàtic; and Llei 21/2013, del 10 d'octubre, for the rehabilitation of buildings, energy efficiency and renewables. The Government pages do not name ISO 14001 or ISO 50001. — govern.ad (accessed 18 Oct 2026)
- The Ministry's accommodation page sets out the registration procedure and the rules for each accommodation group, the tourist accommodation occupancy register (ROAT) and the tourist tax. The page names no ISO standard. — govern.ad (accessed 18 Oct 2026)
- Accreditation of certification bodies that serve Andorra — european-accreditation.org (accessed 18 Oct 2026)
- Public procurement (contractació pública) under the Llei de contractació pública (LCP) and the public-sector procurement platform — govern.ad (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice