Where we work · Bhutan
ISO and GRC certification consulting in Bhutan
Achieve ISO and GRC certification in Bhutan with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Mumbai office team
- Effivity and Academy included
Sectors that ask for certification in Bhutan
Clients include
ISO and GRC certification in Bhutan at a glance
Bhutan's compliance demand rests on a handful of statutes and agencies rather than a long list of sector schemes. The Information, Communications and Media Act of Bhutan 2018 carries privacy duties for ICT and media providers and a short data protection chapter, and the Bhutan InfoComm and Media Authority regulates that sector. The Bhutan Food and Drug Authority, formed by merging the former drug, agriculture and food, and narcotics regulators, licenses food businesses under the Food Act of Bhutan 2005 and registers medicines and medical devices. The GovTech Agency's National Cybersecurity Strategy 2024-2029 sets the direction for critical information infrastructure. Procurement under the Procurement Rules and Regulations 2023 asks bidders for an integrity pact and financial and technical evidence rather than a named ISO certificate. Ferro-alloy makers, hotels, IT service firms, food processors and hydropower companies are the organisations most likely to ask for certification. Certificates come from accredited certification bodies, never from Sterling. Sterling's Mumbai office serves clients in Bhutan, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Bhutan
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Bhutan (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Information, Communications and Media Act of Bhutan 2018 — Chapter 17 (protection of online or offline privacy) and Chapter 21 (data protection) The Bhutan InfoComm and Media Authority (BICMA) is the autonomous regulatory authority the Act establishes for the ICT and media sectors. The Act names no separate data protection authority; offences are tried by the Court, which fixes compensation to the victim. | Chapter 17 requires ICT and media facility or service providers and vendors to respect and protect the privacy of personal information, publish an accessible privacy policy, limit collection, use and disclosure to what a reasonable person would consider appropriate, avoid disclosing personal information to affiliates or third parties without clear opt-in authorisation, stay responsible for information passed to third parties, keep effective controls over the integrity and confidentiality of payment and personal information consistent with current global industry standards, and obtain parental consent before collecting children's personal information. Chapter 21 says a person must obtain the express written permission of the data subject before collecting, collating or processing personal information unless law permits or requires it, must not disclose personal information to a third party without legal authority or the person's written authorisation, and must delete or destroy personal information that has become obsolete, with a proviso allowing statistical use where profiles cannot be linked to a person. The Act defines sensitive personal data to include passwords, financial information, health and medical records, sexual orientation and biometric information. Unauthorised disclosure and breach of confidentiality are offences. The Act names no ISO standard. | |
| National Digital Identity Act of Bhutan 2023 The Strategy does not name the body that enforces the Act; the Strategy is led by the GovTech Agency with the Bhutan Computer Incident Response Team. | The same Strategy states that Bhutan lacks a specific law dedicated to cybersecurity, that the Information, Communications and Media Act of Bhutan 2018 provides broad provisions through Chapters 20 and 21, and that a Data Privacy and Protection Framework can be one regulatory measure to address data privacy and protection, including the handling of sensitive data breaches. | |
| Bhutan InfoComm and Media Authority (BICMA) ICT and media service providers and vendors | Information, Communications and Media Act of Bhutan 2018 — BICMA describes itself as a converged regulator for information, communications and technology, telecom, media and film; the Authority grants licences, certificates and permits, protects consumers of ICT and media services and handles complaints. Security mechanisms for payment and personal information must be consistent with current global industry standards and existing national laws; the Act lets the Ministry, in consultation with the Authority, declare ICT and media infrastructure as critical information infrastructure. The Act names no ISO standard. | ISO/IEC 27001 |
| Bhutan Food and Drug Authority (BFDA) Food businesses and food exporters | Food Act of Bhutan 2005 and Food Rules and Regulations of Bhutan (2017) — BFDA was formed by merging the Drug Regulatory Authority, the Bhutan Agriculture and Food Regulatory Authority and the Bhutan Narcotics Control Authority. Its Food Quality and Safety Division issues food safety licences, inspects imported and exported food and certifies food products for export only where they come from businesses under its official food control system. Its Good Hygiene and Manufacturing Practices Criteria, Version 3, 2024, apply to all food businesses except street food vendors, temporary food stalls and primary producers and are based on the Codex Alimentarius General Principles of Food Hygiene; they cover premises, training, sanitation, operational controls, traceability and recall, records and an annual self-evaluation. The National Food Testing Laboratory is described as accredited to ISO/IEC 17025:2017. The criteria do not name HACCP or ISO 22000. | ISO/IEC 17025 |
| Bhutan Food and Drug Authority (BFDA), Medical Product Division Medicines and medical devices | Medicines Act of Kingdom of Bhutan 2003 — the Division registers medical products manufactured in or imported into Bhutan, authorises their manufacture, import, export, sale, distribution and storage, and inspects premises; it audits manufacturing plants before issuing cGMP certificates. Its Guideline for Registration of Medical Devices 2022 sets the device route. The Division's page does not name ISO 13485. | |
| Government Technology Agency (GovTech), Cybersecurity Division and Bhutan Computer Incident Response Team (BtCIRT) Government networks and critical information infrastructure | National Cybersecurity Strategy 2024-2029 — its goals are institutional governance, a stronger cybersecurity legislative framework, protection of critical information infrastructure and incident response. It names the Royal Monetary Authority, the Electricity Authority and BICMA as key regulators for critical information infrastructure protection, and describes a baseline cybersecurity guideline developed in-house for government agencies. BtCIRT acts as national point of contact and can give obligatory instructions to government agencies, state-owned organisations and critical infrastructure operators. The Strategy does not mention ISO/IEC 27001. | |
| Department of Labour Employers and workplaces | Labour and Employment Act of the Kingdom of Bhutan, 2007 and its Regulations — the Labour Protection Division implements and enforces occupational safety and health rules, runs training, monitors hazards such as noise, dust, heat, vibration and ventilation, operates a clearance facility for imported machinery, equipment and substances, and inspects enterprises, preferring to encourage self-compliance. The page names no ISO standard. | |
| Department of Industry, Ministry of Industry, Commerce and Employment, with the Department of Environment and Climate Change for activities within its jurisdiction Industries needing environmental clearance | Environmental clearance under A Guide to Environmental Clearance Application Procedure (May 2022) — the Department of Industry's annual report for 2025-2026 states that an environmental clearance is a prerequisite for development consent for activities needing an initial environmental examination or an environmental impact assessment, which fall under the Blue and Red Category Lists. The report does not name ISO 14001. | |
| Gelephu Financial Services Office (GFSO) Financial services firms in Gelephu Mindfulness City | Financial Services Act 2025 (Law No. 5 of 2025) — GFSO describes itself as the independent regulator of all financial services in the city, covering traditional finance and blockchain and digital assets, and firms follow its rulebooks and virtual asset guidance. The pages name no ISO standard. | |
| Anti-Corruption Commission (ACC) Companies bidding for contracts and dealing with officials | Anti-Corruption Act of Bhutan 2011 — the Commission describes itself as a constitutionally independent body that supports reporting, investigating, exposing and preventing corruption, and accepts complaints about corrupt conduct whether public or private. The page names no ISO standard. |
Accreditation and recognition
- Bhutan Standards Bureau (BSB): National standards body, established under the Bhutan Standards Act 2010; its site states its mandate includes developing national standards, operating metrology and testing laboratories, and permitting, coordinating and facilitating the accreditation of laboratories and certification bodies; it does not describe itself as an accreditation body.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Procurement Rules and Regulations 2023 (Ministry of Finance (Procurement Management and Development Division, Department of Procurement and Properties)): The Rules apply to government agencies and state that they come into effect from 1 July 2023. Bidders are required to observe the highest standards of ethics, and as a condition of eligibility to sign and attach an Integrity Pact Statement provided in the bidding documents. Registers of suppliers, consultants and contractors and prequalification use criteria for general suitability, financial capacity (audited balance sheets, turnover statements, tax clearance) and technical ability (qualifications of managerial staff, lists of works or deliveries with client certificates, and technical facilities). The Rules do not name ISO standards; each bidding document sets its own evidence.
Economic zones
- Bjemina Industrial Estate: wood products, construction materials, fabrication
- Pasakha Industrial Estate: metal processing, chemical processing, plastics, consumer goods, construction materials
- Dhamdum Industrial Park: clean-tech, low-polluting industries
- Norbugang Industrial Park: ferro-alloys
- Phuntshorabtenling Industrial Park: manufacturing
- Gelephu Mindfulness City: health and wellness, education, agri-tech and forestry, green energy, finance and digital assets, aviation and logistics, tourism
Sterling in Bhutan
Sterling delivers in Bhutan from its Mumbai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Bhutan clients ask
Does Bhutan have a data protection law?
Bhutan has data protection rules inside the Information, Communications and Media Act of Bhutan 2018, mainly Chapters 17 and 21, which require written permission to collect personal information, bar disclosure without authority and require obsolete data to be deleted. The National Cybersecurity Strategy 2024-2029 notes there is no stand-alone cybersecurity law. Ask your counsel how the provisions apply to your operations.
Which regulator oversees privacy and data handling in Bhutan?
The Bhutan InfoComm and Media Authority regulates the ICT and media sector under the 2018 Act, granting licences and handling consumer complaints. The Act names no separate data protection authority, and offences are tried by the Court, which sets compensation for the victim. Confirm with the Authority or your counsel which body would act on a particular complaint.
Who licenses food businesses and certifies food exports in Bhutan?
The Bhutan Food and Drug Authority does both. Its Food Quality and Safety Division issues food safety licences under the Food Act of Bhutan 2005, applies its Good Hygiene and Manufacturing Practices Criteria, and certifies food products for export only where they come from businesses under its official food control system. Check current licensing steps with the Authority before you plan an audit.
Is there a national accreditation body for certification bodies in Bhutan?
The Bhutan Standards Bureau develops national standards and, as its site states, coordinates and facilitates accreditation of laboratories and certification bodies, but it does not describe itself as an accreditation body. Certificates used in Bhutan usually carry accreditation from another economy within the international arrangements, so ask any certification body for its accreditation certificate and scope.
Do Bhutan's procurement rules require ISO certification from bidders?
No ISO standard is named in the Procurement Rules and Regulations 2023. They ask bidders for an Integrity Pact Statement, evidence of financial capacity and evidence of technical ability, and each bidding document sets its own evidence. Read the qualification clause of the tender you intend to answer, and ask the procuring agency whether a management system certificate would count.
Which language is used for audits and documents in Bhutan?
Either Dzongkha or English can be agreed. Bhutan's laws are published in both, and for the 2018 Information, Communications and Media Act the Dzongkha text prevails where the two differ. Management system documents may be in either language or both, so decide the audit language, any interpreter and the language of controlled documents with the certification body at application.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Information, Communications and Media Act of Bhutan 2018 — Chapter 17 (protection of online or offline privacy) and Chapter 21 (data protection) — bicma.gov.bt (accessed 18 Oct 2026)
- National Digital Identity Act of Bhutan 2023 — tech.gov.bt (accessed 18 Oct 2026)
- Information, Communications and Media Act of Bhutan 2018 — bicma.gov.bt (accessed 18 Oct 2026)
- Food Act of Bhutan 2005 and Food Rules and Regulations of Bhutan (2017) — bfda.gov.bt (accessed 18 Oct 2026)
- Medicines Act of Kingdom of Bhutan 2003 — bfda.gov.bt (accessed 18 Oct 2026)
- National Cybersecurity Strategy 2024-2029 — tech.gov.bt (accessed 18 Oct 2026)
- Labour and Employment Act of the Kingdom of Bhutan, 2007 and its Regulations — molhr.gov.bt (accessed 18 Oct 2026)
- Environmental clearance under A Guide to Environmental Clearance Application Procedure (May 2022) — moice.gov.bt (accessed 18 Oct 2026)
- Financial Services Act 2025 (Law No. 5 of 2025) — gmc.bt (accessed 18 Oct 2026)
- Anti-Corruption Act of Bhutan 2011 — acc.org.bt (accessed 18 Oct 2026)
- Bhutan Standards Bureau (BSB) — bsb.gov.bt (accessed 18 Oct 2026)
- Procurement Rules and Regulations 2023 — mof.gov.bt (accessed 18 Oct 2026)
- Bjemina Industrial Estate — moice.gov.bt (accessed 18 Oct 2026)
- Pasakha Industrial Estate — moice.gov.bt (accessed 18 Oct 2026)
- Dhamdum Industrial Park — moice.gov.bt (accessed 18 Oct 2026)
- Norbugang Industrial Park — moice.gov.bt (accessed 18 Oct 2026)
- Phuntshorabtenling Industrial Park — moice.gov.bt (accessed 18 Oct 2026)
- Gelephu Mindfulness City — gmc.bt (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Navi Mumbai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
india@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice