Where we work · Bangladesh
ISO and GRC certification consulting in Bangladesh
Achieve ISO and GRC certification in Bangladesh with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 23 standards, one team
- Accredited certification route
- Mumbai office team
- Effivity and Academy included
Sectors that ask for certification in Bangladesh
- Ready-made garments, textiles and knitwear exporters
- Footwear, leather and home-textile suppliers
- Food processing and agro-food exporters
- Pharmaceutical and medical product makers
- Banks, non-bank lenders, mobile financial services and payments
- IT, IT-enabled services and BPO firms serving overseas clients
Clients include
ISO and GRC certification in Bangladesh at a glance
Bangladesh's certification demand is driven by buyers abroad and by a growing body of national law. Labour rules sit in the Bangladesh Labour Act, 2006, amended in 2026, with the Department of Inspection for Factories and Establishments inspecting workplaces, and the Bangladesh EPZ Labour Act, 2019 covers enterprises in the export processing zones run by BEPZA. Data rules arrived in April 2026 with the Personal Data Protection Act, the National Data Management Act and the Cyber Security Act. Bangladesh Bank's ICT security guideline tells banks and financial institutions to obtain industry-standard certification in areas such as information security, quality, service delivery, continuity and payment card data. The Bangladesh Accreditation Board accredits conformity assessment bodies and the Bangladesh Standards and Testing Institution sets national standards. Demand comes from garment and textile exporters, food and pharmaceutical makers, financial and IT firms and zone enterprises, and certificates are issued by accredited certification bodies, never by Sterling. Sterling's Mumbai office serves clients in Bangladesh on-site where the work needs it and remotely otherwise, with 8,100+ client engagements in 60+ countries, 20+ years, and Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Bangladesh
Each page covers who needs the standard in Bangladesh, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Social accountability & human rights
Regulators and laws that drive certification in Bangladesh (13)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Data Protection Act, 2026 (ব্যক্তিগত উপাত্ত সুরক্ষা আইন, ২০২৬) National Data Management Authority, the authority established under section 8 of the National Data Management Act, 2026 | Provides for protecting personal data on the basis that a person's personal data is treated as that person's own, and for lawful processing with consent. It applies to Bangladeshi citizens and residents and to anyone processing personal data inside Bangladesh, and it reaches processing abroad that relates to goods or services offered to, or monitoring of, people in Bangladesh. It defines data-fiduciaries, processors, data subjects, significant data-fiduciaries, profiling and sensitive categories such as biometric, genetic and financial data, and it refers to independent data auditors. Section 1(3) says that all sections except section 23 and sections 31 to 35 are deemed to have taken effect on 6 November 2025, and that those sections take effect on a date the Government notifies in the Gazette after a period counted from promulgation. It creates no certificate. | |
| National Data Management Act, 2026 (জাতীয় উপাত্ত ব্যবস্থাপনা আইন, ২০২৬) National Data Management Authority (established under section 8) | Sets the framework for national data management and data interoperability and provides for the authority that the Personal Data Protection Act, 2026 names as its regulator. Its preamble refers to consent-based, lawful handling of personal data and to remedies for breaches. | |
| Cyber Security Act, 2026 (সাইবার সুরক্ষা আইন, ২০২৬) National Cyber Security Agency and National Cyber Security Council, both provided for in the Act | Provides for cyber security and for the offences, investigation and trial of crimes in cyberspace. It has chapters on the Agency, on preventive measures including computer emergency response teams and digital forensic labs, and on critical information infrastructure, including security monitoring, inspection and audit of that infrastructure. It cites no standard and creates no certificate. | |
| Ministry of Labour and Employment and the Department of Inspection for Factories and Establishments (DIFE) Employers and factories | Bangladesh Labour Act, 2006 (বাংলাদেশ শ্রম আইন, ২০০৬; Act No. XLII of 2006, dated 11 October 2006), whose preamble covers employment of workers, employer-worker relations, minimum wages, payment of wages, compensation for injury, trade unions, industrial disputes, and workers' health, safety, welfare and working conditions; the Bangladesh Labour (Amendment) Act, 2026 (Act No. 43 of 2026, dated 10 April 2026) amends it further. DIFE's site names it as the Department of Inspection for Factories and Establishments under the Ministry of Labour and Employment, and DIFE's Labour Inspection Management Application offers an application for a licence of establishment. The Act does not name an ISO or SA standard. | SA8000 Standard for Decent Work, ISO 45001, SMETA audit (Sedex) |
| Bangladesh Export Processing Zones Authority (BEPZA) Enterprises inside export processing zones | Bangladesh EPZ Labour Act, 2019 (বাংলাদেশ ইপিজেড শ্রম আইন, ২০১৯; Act No. 2 of 2019, dated 28 February 2019), which provides for employment of workers in zone enterprises, relations between employer and worker, minimum wages, wage payment, compensation for injury, workers' health and safety, and workers' welfare associations. BEPZA states that it was established under the BEPZA Act, 1980 to create, develop, operate, manage and control Export Processing Zones. | SA8000 Standard for Decent Work, ISO 45001, SMETA audit (Sedex) |
| Bangladesh Food Safety Authority Food businesses, processors and importers | Safe Food Act, 2013 (নিরাপদ খাদ্য আইন, ২০১৩; Act No. 43 of 2013, dated 10 October 2013) — regulates production, import, processing, storage, supply, marketing and sale of food; its functions include licensing and inspection of food establishments and supporting the policy on accreditation of bodies that certify food safety management systems and of food laboratories. The Act does not name ISO 22000 or HACCP. | ISO 22000, HACCP, FSSC 22000, ISO/IEC 17025 |
| Directorate of Drug Administration (ঔষধ প্রশাসন অধিদপ্তর) Medicine, cosmetics and medical device businesses | Drugs and Cosmetics Act, 2023 (ঔষধ ও কসমেটিকস্ আইন, ২০২৩; Act No. 29 of 2023, dated 18 September 2023) — covers production, import, export, sale, storage and quality control of drugs and cosmetics, defines Good Manufacturing Practice by reference to World Health Organization guidelines, and refers to trials of medicines, vaccines and medical devices. It does not name ISO 13485. | ISO 13485 |
| Bangladesh Bank Banks, non-bank financial institutions and payment-card operators | Guideline on ICT Security, Version 4.0 (2023), issued under BRPD Circular No. 10 dated 19 June 2023 — for banks and non-bank financial institutions; it says the organisation shall obtain industry-standard certification in at least a few areas, preferably all, such as information system security, ICT risk management, data centre standard, quality management systems, ICT service delivery, business continuity management and payment card data security; it also requires annual internal information system audits and external audit by qualified auditors. The guideline does not name a specific standard in that clause. | ISO/IEC 27001, ISO 9001, ISO/IEC 20000-1, ISO 22301, PCI DSS, SOC 2 |
| Department of Environment (পরিবেশ অধিদপ্তর) Industry, energy and construction projects with pollution potential | Bangladesh Environment Conservation Act, 1995 (বাংলাদেশ পরিবেশ সংরক্ষণ আইন, ১৯৯৫; Act No. 1 of 1995, dated 16 February 1995) — provides for environmental conservation, improvement of environmental standards and control and mitigation of pollution, and establishes the Department of Environment in section 3. It does not name ISO 14001. | ISO 14001, ISO 50001 |
| Fire service authorities under the Act Factories and warehouses (fire safety) | Fire Prevention and Extinguishment Act, 2003 (অগ্নি প্রতিরোধ ও নির্বাপণ আইন, ২০০৩; Act No. 7 of 2003, dated 6 March 2003) — its contents list a section on licences for warehouses and factories and one on approval of plans for multi-storey and commercial buildings. It does not name ISO 45001. | ISO 45001 |
| Bangladesh Standards and Testing Institution (BSTI) Manufacturers and importers of products under Bangladesh Standards | Bangladesh Standards and Testing Institution Act, 2018 (বাংলাদেশ স্ট্যান্ডার্ডস এন্ড টেস্টিং ইনস্টিটিউশন আইন, ২০১৮; Act No. 67 of 2018, dated 14 November 2018), which repeals the 1985 Ordinance — the Institution implements Bangladesh Standards by running a national certification mark scheme or by inspecting products, tests and calibrates, approves laboratories and can issue quality clearance for imported goods. | ISO/IEC 17025, ISO 9001 |
| National Cyber Security Agency Operators of critical information infrastructure and digital services | Cyber Security Act, 2026 — critical information infrastructure is covered by its own chapter, with security monitoring, inspection and audit; see the data_protection entry for the Act. | ISO/IEC 27001, ISO 22301 |
| Anti-Corruption Commission Public and private bodies exposed to bribery and corruption risk | Anti-Corruption Commission Act, 2004 (দুর্নীতি দমন কমিশন আইন, ২০০৪; Act No. 5 of 2004, dated 23 February 2004). The Act does not name ISO 37001. | ISO 37001, ISO 37301 |
Accreditation and recognition
- Bangladesh Accreditation Board (BAB): National accreditation body that accredits conformity assessment bodies.
- Bangladesh Standards and Testing Institution (BSTI): National standards body that implements Bangladesh Standards, runs a national certification mark scheme, and tests, calibrates and approves laboratories.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public Procurement Act, 2006 and the Bangladesh Public Procurement Authority Act, 2023 (Bangladesh Public Procurement Authority): The 2006 Act (Act No. 24 of 2006, dated 6 July 2006) governs procurement of goods, works and services with public funds and, as amended, names quality and sustainable procurement among its aims; the 2023 Act (Act No. 32 of 2023) establishes the Authority to implement and oversee the procurement law. Eligibility and the evidence required, such as a quality or safety certificate, are set in each tender document.
Economic zones
- Export Processing Zones run by BEPZA: ready-made garments, diversified manufacturing for export
- BEPZA Economic Zone, Mirsharai, Chattogram: export-oriented manufacturing
- Jashore and Patuakhali EPZ projects: export-oriented manufacturing
Sterling in Bangladesh
Sterling delivers in Bangladesh from its Mumbai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Bangladesh, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Bangladeshi clients ask
Which body accredits certification bodies in Bangladesh?
The Bangladesh Accreditation Board is the national accreditation body. ILAC's 2020 news item says its signatory status under the ILAC arrangement was extended to medical testing and inspection. For management system certificates, ask the certification body for its accreditation certificate and scope, and check that it covers your standard and your industry before commissioning an audit.
Does Bangladesh have a personal data protection law?
Yes. The Laws of Bangladesh portal lists the Personal Data Protection Act, 2026, Act No. 63 of 2026, dated 10 April 2026, with the National Data Management Authority as its regulator. Most sections are deemed in effect from November 2025, while a few take effect when the Government notifies a date. Confirm current obligations for your business with counsel or the Authority.
Does a separate labour law apply inside export processing zones?
Yes. Enterprises in the zones are covered by the Bangladesh EPZ Labour Act, 2019, Act No. 2 of 2019, which deals with employment, wages, injury compensation, workers' health and safety and welfare associations. BEPZA administers the zones under its 1980 Act. Check with BEPZA or counsel which provisions apply to your enterprise and whether buyer audits add further conditions.
Does Bangladesh Bank expect banks to hold ISO certifications?
Its ICT security guideline, version 4.0 of 2023, says the organisation shall obtain industry-standard certification in at least a few areas, preferably all, including information system security, quality management, business continuity and payment card data security. It names no particular standard in that clause. Confirm with Bangladesh Bank how your institution is expected to respond.
Can audits in Bangladesh be carried out in English?
Documents and reports are usually in English, since buyer standards and export paperwork are written in it, although the Constitution names Bangla as the state language. Interviews with workers and supervisors are normally held in Bangla. Settle the audit language, any interpreter and the language of controlled documents with the certification body when you apply.
How should audits be planned around Eid and other holidays?
Plan early, because Eid holidays, Ramadan working hours and other public holidays follow the lunar calendar and the Government's holiday list, so the dates change every year. Tell the certification body which sites you run and when they close, and agree audit dates around those shutdowns instead of relying on a fixed calendar.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Act, 2026 (ব্যক্তিগত উপাত্ত সুরক্ষা আইন, ২০২৬) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- National Data Management Act, 2026 (জাতীয় উপাত্ত ব্যবস্থাপনা আইন, ২০২৬) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Cyber Security Act, 2026 (সাইবার সুরক্ষা আইন, ২০২৬) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Bangladesh Labour Act, 2006 (বাংলাদেশ শ্রম আইন, ২০০৬; Act No. XLII of 2006, dated 11 October 2006), whose preamble covers employment of workers, employer-worker relations, minimum wages, payment of wages, compensation for injury, trade unions, industrial disputes, and workers' health, safety, welfare and working conditions; the Bangladesh Labour (Amendment) Act, 2026 (Act No. 43 of 2026, dated 10 April 2026) amends it further. DIFE's site names it as the Department of Inspection for Factories and Establishments under the Ministry of Labour and Employment, and DIFE's Labour Inspection Management Application offers an application for a licence of establishment. The Act does not name an ISO or SA standard. — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Bangladesh EPZ Labour Act, 2019 (বাংলাদেশ ইপিজেড শ্রম আইন, ২০১৯; Act No. 2 of 2019, dated 28 February 2019), which provides for employment of workers in zone enterprises, relations between employer and worker, minimum wages, wage payment, compensation for injury, workers' health and safety, and workers' welfare associations. BEPZA states that it was established under the BEPZA Act, 1980 to create, develop, operate, manage and control Export Processing Zones. — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Safe Food Act, 2013 (নিরাপদ খাদ্য আইন, ২০১৩; Act No. 43 of 2013, dated 10 October 2013) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Drugs and Cosmetics Act, 2023 (ঔষধ ও কসমেটিকস্ আইন, ২০২৩; Act No. 29 of 2023, dated 18 September 2023) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Guideline on ICT Security, Version 4.0 (2023), issued under BRPD Circular No. 10 dated 19 June 2023 — bb.org.bd (accessed 11 Oct 2026)
- Bangladesh Environment Conservation Act, 1995 (বাংলাদেশ পরিবেশ সংরক্ষণ আইন, ১৯৯৫; Act No. 1 of 1995, dated 16 February 1995) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Fire Prevention and Extinguishment Act, 2003 (অগ্নি প্রতিরোধ ও নির্বাপণ আইন, ২০০৩; Act No. 7 of 2003, dated 6 March 2003) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Bangladesh Standards and Testing Institution Act, 2018 (বাংলাদেশ স্ট্যান্ডার্ডস এন্ড টেস্টিং ইনস্টিটিউশন আইন, ২০১৮; Act No. 67 of 2018, dated 14 November 2018), which repeals the 1985 Ordinance — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Cyber Security Act, 2026 — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Anti-Corruption Commission Act, 2004 (দুর্নীতি দমন কমিশন আইন, ২০০৪; Act No. 5 of 2004, dated 23 February 2004). The Act does not name ISO 37001. — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Bangladesh Accreditation Board (BAB) — ilac.org; iaf.nu (accessed 11 Oct 2026)
- Bangladesh Standards and Testing Institution (BSTI) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Public Procurement Act, 2006 and the Bangladesh Public Procurement Authority Act, 2023 — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Export Processing Zones run by BEPZA — bepza.gov.bd (accessed 11 Oct 2026)
- BEPZA Economic Zone, Mirsharai, Chattogram — bepza.gov.bd (accessed 11 Oct 2026)
- Jashore and Patuakhali EPZ projects — bepza.gov.bd (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Navi Mumbai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
india@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice