Where we work · Angola
ISO and GRC certification consulting in Angola
Achieve ISO and GRC certification in Angola with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Johannesburg office team
- Effivity and Academy included
Sectors that ask for certification in Angola
Clients include
ISO and GRC certification in Angola at a glance
Demand for management system certification in Angola follows its regulators and its resource sectors. The Agência de Protecção de Dados supervises Lei n.º 22/11, the Data Protection Law, under which controllers notify the Agency or seek its authorisation before processing, and APD Circular n.º 02/APD/2024 asks them to report security incidents. INACOM regulates electronic communications, the Comissão do Mercado de Capitais supervises the capital market, ANPG and ANRM oversee oil, gas and mining, and the agriculture ministry and its veterinary services institute cover farm and food-origin products. Oil and gas suppliers, miners, agro-processors, telecoms and ICT firms, financial institutions and testing laboratories generate most enquiries. Angola has no national accreditation body, so SADCAS serves it, and certificates come from accredited certification bodies, never from Sterling. Sterling's Johannesburg office serves clients across Angola, on site where the work needs it and remotely otherwise, with 8,100+ client engagements in 60+ countries, 20+ years of practice, and Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in Angola
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Angola (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Lei n.º 22/11, de 17 de Junho (Lei da Protecção de Dados Pessoais) Agência de Protecção de Dados (APD), a public-law body with legal personality and administrative, financial and patrimonial autonomy under article 44; its organic statute is Decreto Presidencial n.º 214/16, de 10 de Outubro | Applies to processing of personal data by public, private and cooperative bodies, by wholly or partly automated means and in manual files, and reaches controllers outside Angola that use means located in Angola, who then name a representative established in Angola. Processing needs the data subject's unequivocal and express consent unless an exception applies, plus notification to the APD or its authorisation. Sensitive, health, credit and interconnection cases need the APD's authorisation. The law sets principles of transparency, lawfulness, proportionality, purpose, accuracy and limited retention, requires technical and organisational security measures with a written security document, regulates communication to processors and third parties and transfers abroad, and gives data subjects rights of information, access, objection, rectification, updating and erasure. | |
| APD Circular n.º 02/APD/2024 — mandatory notification of informatics accidents and incidents Agência de Protecção de Dados (APD) | Public and private controllers notify the APD as soon as they become aware of a personal data breach or other security accident or incident. The notice is confidential and describes the nature of the breach, including the type of data and approximate number of people affected where possible, its probable consequences, and the measures taken or proposed; if details are not yet available they follow without undue delay. | |
| Companion instruments listed by the APD: Lei n.º 23/11 (electronic communications), Lei n.º 7/17 (protection of networks and informatics systems), Lei n.º 2/20 and Decreto Presidencial n.º 308/21 (video surveillance), Decreto Presidencial n.º 275/20 (private credit information centres) Agência de Protecção de Dados (APD) for personal data aspects; INACOM for the electronic communications market | The page groups these instruments as the relevant national legislation on data protection. The circular above shows that Lei n.º 7/17 obliges operators of publicly available electronic communications and main storage providers to take protective measures for personal data, and the APD's fee instruments refer to its authorisation of private credit information centres. | |
| Draft revision of Lei n.º 22/11 — consultation notice on the APD website Agência de Protecção de Dados (APD) | A draft revision exists for public comment. Read the current official text before relying on any provision, and confirm the position with the APD or counsel. | |
| Instituto Angolano das Comunicações (INACOM); the APD for personal data security Electronic communications operators, hosting providers and postal services | INACOM describes itself as the body created to regulate, supervise and inspect the electronic communications market and postal services, with company registration, multi-service licences and equipment marketing authorisation; Lei n.º 7/17 and Lei n.º 23/11 are the instruments the APD circular uses for network operators and main storage providers. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 |
| Comissão do Mercado de Capitais (CMC) Capital market participants: brokers, fund managers, issuers, regulated-market operators and external auditors | The CMC describes itself as the entity regulating the capital market in Angola; its site lists registered entities by category, publishes a regulatory agenda and a risk-based supervision plan, and carries AML/CFT material. | ISO/IEC 27001, ISO 22301, SOC 2 |
| ARSEG Insurers, pension fund managers and insurance mediators | ARSEG's site covers authorised insurers, pension funds and mediators, market legislation, circulars and AML/CFT guidance. | ISO/IEC 27001 |
| Agência Nacional de Petróleo, Gás e Biocombustíveis (ANPG) Oil, gas and biofuels operators and their suppliers | ANPG's 2025 management report describes it as the National Concessionaire, responsible for regulating, supervising and promoting petroleum, gas and biofuel activity, managing petroleum mining rights and licensing; it reports a supplier registration and verification system with more than 3,100 suppliers registered at the end of 2025. | ISO 9001, ISO 14001, ISO 45001, ISO 50001 |
| Agência Nacional de Recursos Minerais (ANRM) Mining operators and processors | ANRM's site states its mission as promoting, regulating and supervising the Angolan mining sector; its sections cover licensing, mining rights, the mining tax regime, inspection to reduce environmental impact, a certificate of origin and a mineral export guide. | ISO 14001, ISO 45001, ISO 9001 |
| Ministério da Agricultura e Florestas (MINAGRIF) and its Instituto dos Serviços de Veterinária (ISV) Farms, agro-processors and food of animal origin | The ministry's published functions include supporting production, transport, processing, packing and marketing of agricultural, livestock and forest products and food security; its communications show the ISV carrying out routine sanitary control and public health protection actions at the Port of Luanda. | ISO 22000, HACCP, FSSC 22000 |
| Instituto Regulador dos Serviços de Electricidade e de Água (IRSEA) Electricity and water utilities and their customers | IRSEA describes itself as a public-law institute of the economic sector regulating electricity and water services; its site covers tariffs, legislation, publications and consumers, and its news records an approved partial adjustment of electricity tariffs. | ISO 50001 |
| Autoridade Nacional de Aviação Civil (ANAC) Civil aviation operators, maintenance organisations and aeronautical personnel | ANAC's site lists Lei n.º 14/19 (Lei da Aviação Civil), the national civil aviation security programme and sections for air operators, maintenance organisations, aerodromes and airworthiness. | AS9100 |
Accreditation and recognition
- Southern African Development Community Accreditation Services (SADCAS): Multi-economy accreditation body; SADCAS states that Angola is one of the SADC economies without a national accreditation body that it serves.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Sterling in Angola
Sterling delivers in Angola from its Johannesburg office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Angola clients ask
Which law protects personal data in Angola?
The Data Protection Law, Lei n.º 22/11, de 17 de Junho, supervised by the Agência de Protecção de Dados. It covers public, private and cooperative bodies, automated and manual files, and controllers abroad that use means located in Angola. The APD website also carries a draft revision for comment, so check the current official text with your counsel before relying on a provision.
Must organisations notify the APD before processing personal data?
In general yes. The law makes the data subject's unequivocal and express consent, together with notification to the APD or its authorisation, the basis for processing, with listed exceptions to consent. Sensitive, health, credit and interconnection cases need authorisation, and notifications describe the controller, purposes, data, recipients, retention, transfers and security. Confirm your own category with the APD.
Must a personal data breach be notified in Angola?
APD Circular n.º 02/APD/2024 tells public and private controllers to notify the Agency as soon as they become aware of a breach or other security incident, in confidence. The notice covers the nature of the breach, probable consequences and the measures taken or proposed, and missing details follow without undue delay. Ask the APD or your counsel how the circular applies to your sector.
Does Angola have a national accreditation body?
No. Angola relies on SADCAS, the regional body for SADC economies that lack their own, and SADCAS names Angola among those it serves. Angolan calibration and testing laboratories and an inspection body already appear on its accredited list. For certification bodies its scheme lists quality, environment, safety and food safety, so read the scope on every certificate.
Who regulates mining and oil and gas in Angola?
ANRM promotes, regulates and supervises the mining sector, according to its site, while ANPG is the National Concessionaire with regulation and supervision functions for petroleum, gas and biofuels and runs a supplier registration system. Neither description makes an ISO certificate compulsory, so ask the regulator or your customer which evidence they expect.
In which language are audits carried out in Angola?
Portuguese in most cases, because legislation, Data Protection Agency guidance and regulator websites are published in it, though oil, mining and export customers may prefer English. Decide with the certification body at application which language the audit, any interpreter and the controlled documents will use, and keep translated procedures as controlled copies.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Lei n.º 22/11, de 17 de Junho (Lei da Protecção de Dados Pessoais) — apd.ao (accessed 18 Oct 2026)
- APD Circular n.º 02/APD/2024 — mandatory notification of informatics accidents and incidents — apd.ao (accessed 18 Oct 2026)
- Companion instruments listed by the APD: Lei n.º 23/11 (electronic communications), Lei n.º 7/17 (protection of networks and informatics systems), Lei n.º 2/20 and Decreto Presidencial n.º 308/21 (video surveillance), Decreto Presidencial n.º 275/20 (private credit information centres) — apd.ao (accessed 18 Oct 2026)
- Draft revision of Lei n.º 22/11 — consultation notice on the APD website — apd.ao (accessed 18 Oct 2026)
- INACOM describes itself as the body created to regulate, supervise and inspect the electronic communications market and postal services, with company registration, multi-service licences and equipment marketing authorisation; Lei n.º 7/17 and Lei n.º 23/11 are the instruments the APD circular uses for network operators and main storage providers — inacom.gov.ao; apd.ao (accessed 18 Oct 2026)
- The CMC describes itself as the entity regulating the capital market in Angola; its site lists registered entities by category, publishes a regulatory agenda and a risk-based supervision plan, and carries AML/CFT material — cmc.ao (accessed 18 Oct 2026)
- ARSEG's site covers authorised insurers, pension funds and mediators, market legislation, circulars and AML/CFT guidance — arseg.ao (accessed 18 Oct 2026)
- ANPG's 2025 management report describes it as the National Concessionaire, responsible for regulating, supervising and promoting petroleum, gas and biofuel activity, managing petroleum mining rights and licensing; it reports a supplier registration and verification system with more than 3,100 suppliers registered at the end of 2025 — anpg.co.ao (accessed 18 Oct 2026)
- ANRM's site states its mission as promoting, regulating and supervising the Angolan mining sector; its sections cover licensing, mining rights, the mining tax regime, inspection to reduce environmental impact, a certificate of origin and a mineral export guide — anrm.gov.ao (accessed 18 Oct 2026)
- The ministry's published functions include supporting production, transport, processing, packing and marketing of agricultural, livestock and forest products and food security; its communications show the ISV carrying out routine sanitary control and public health protection actions at the Port of Luanda — minagrif.gov.ao (accessed 18 Oct 2026)
- IRSEA describes itself as a public-law institute of the economic sector regulating electricity and water services; its site covers tariffs, legislation, publications and consumers, and its news records an approved partial adjustment of electricity tariffs — irsea.gov.ao (accessed 18 Oct 2026)
- ANAC's site lists Lei n.º 14/19 (Lei da Aviação Civil), the national civil aviation security programme and sections for air operators, maintenance organisations, aerodromes and airworthiness — inavic.gov.ao (accessed 18 Oct 2026)
- Southern African Development Community Accreditation Services (SADCAS) — sadcas.org (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice