Where we work · Brazil
ISO and GRC certification consulting in Brazil
Achieve ISO and GRC certification in Brazil with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- New York office team
- Effivity and Academy included
Sectors that ask for certification in Brazil
- Banks, fintechs and payment institutions
- Software, SaaS and technology services firms
- BPO and customer-service operations serving overseas clients
- Manufacturers and exporters in automotive, machinery and industrial supply chains
- Food, beverage and agribusiness processors
- Medical device, pharmaceutical and health-product makers
Clients include
ISO and GRC certification in Brazil at a glance
Brazilian demand for certification is shaped by a short list of rules and a large export and services economy. The Lei Geral de Proteção de Dados is enforced by the Agência Nacional de Proteção de Dados, which Planalto's text describes as a special-nature autarchy linked to the Ministry of Justice and Public Security. Banks, fintechs and payment institutions answer to the Banco Central do Brasil's cybersecurity and cloud contracting resolutions, while companies dealing with government meet the Anti-Corruption Law and the integrity programme duties in the new tenders law. Health products fall under Anvisa, food under the Ministry of Agriculture's inspection services, and every employer under the occupational risk rules of NR-1. Certificates themselves come from accredited certification bodies, with accreditation by Inmetro's Cgcre, a Global ACI Full Member. Sterling's New York office serves Brazil, drawing on 8,100+ client engagements in 60+ countries and 20+ years, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Brazil
Each page covers who needs the standard in Brazil, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Brazil (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Lei Geral de Proteção de Dados Pessoais (LGPD) — General Personal Data Protection Law Agência Nacional de Proteção de Dados (ANPD) | Applies to any processing of personal data by a person or a public or private legal entity, whatever the country of its seat or of the data, where the processing is carried out in Brazil, aims to offer goods or services to people located in Brazil or to process their data, or concerns data collected in Brazil. It sets ten principles (including purpose, necessity, transparency, security, prevention, non-discrimination and accountability), a closed list of legal bases such as consent, legal obligation, contract, legitimate interest and credit protection, and data subject rights including confirmation, access, correction, anonymisation or deletion, portability and information on sharing. Controllers must appoint an encarregado (data protection officer) whose contact details are public, adopt security measures, keep records of processing, report security incidents that may cause relevant risk or harm to the ANPD and to data subjects, and base international transfers on adequacy or on the safeguards the Law lists. Controllers and processors may adopt good-practice and governance rules, and the ANPD may require an impact report. The Law does not name any ISO standard. | |
| Agência Nacional de Proteção de Dados (ANPD) — legal form and regulations Agência Nacional de Proteção de Dados (ANPD) | Planalto's text of Art. 55-A reads that the ANPD is an autarquia de natureza especial (special-nature autarchy) linked to the Ministry of Justice and Public Security, with functional, technical, decision-making, administrative and financial autonomy, its own assets and its seat in the Federal District, under Law No. 13,848 of 25 June 2019, the law on the management, organisation, decision process and social control of regulatory agencies. The ANPD's site describes a regulatory process that produces regulations, guidance and statements, and publishes Resolução CD/ANPD nº 15 of 24 April 2024, the regulation on communicating security incidents. | |
| Estatuto Digital da Criança e do Adolescente (Law No. 15,211 of 17 September 2025) Agência Nacional de Proteção de Dados (ANPD), which publishes ECA Digital material on its site | Applies to information technology products and services directed at children and adolescents in Brazil or likely to be accessed by them, wherever they are developed, made, offered or operated. Check the current text of the Law and the ANPD's guidance for obligations and dates. | |
| Banco Central do Brasil (BCB) and the Conselho Monetário Nacional (CMN) Banks, financial institutions, payment institutions, brokers and exchange houses authorised by the Banco Central do Brasil | Resolução CMN nº 4.893 of 26 February 2021 and Resolução BCB nº 85 of 8 April 2021 on the cybersecurity policy and on the requirements for contracting data processing, data storage and cloud computing services; the CMN text applies to institutions authorised by the Banco Central, and the BCB text to payment institutions, securities brokers and distributors and exchange brokers. They require a cybersecurity policy, incident handling, continuity-test scenarios and due diligence on service providers. Neither text names ISO/IEC 27001 or PCI DSS. | |
| Controladoria-Geral da União (CGU) at federal level, with other bodies of each branch and level of government Companies dealing with the public sector, and companies exposed to bribery and corruption risk | Law No. 12,846 of 1 August 2013 (Lei Anticorrupção) on the administrative and civil liability of legal entities for acts against the public administration, and Decree No. 11,129 of 11 July 2022, which regulates it and defines an integrity programme as internal integrity, audit and whistleblowing mechanisms and the effective application of codes of ethics and conduct. The Law lists the existence of such mechanisms among the factors considered when applying sanctions, and creates the Cadastro Nacional de Empresas Punidas (CNEP). | ISO 37001, ISO 37301 |
| Agência Nacional de Vigilância Sanitária (Anvisa) Medicines, medical devices, cosmetics, cleaning products, food and other products under health surveillance | Law No. 9,782 of 26 January 1999, which defines the National Health Surveillance System and creates Anvisa. Anvisa issues Certificates of Good Manufacturing Practices (CBPF) and of Good Distribution and Storage Practices (CBPDA) and publishes lists of certified companies, including for health products; its site also carries a MDSAP topic. A management system certificate does not replace Anvisa's registration or good practice certificates. | |
| Ministério da Agricultura e Pecuária (MAPA) Meat, dairy, fish, eggs, honey and plant-origin food producers and agribusiness exporters | MAPA's site carries sections on the inspection of products of animal origin and of plant origin and on agro-industry. Inspection services and sanitary rules apply to the plant and the product; a food safety certificate does not replace them. | |
| Ministério do Trabalho e Emprego (MTE), through its Secretaria de Inspeção do Trabalho Employers and their contractors | Norma Regulamentadora nº 1 (NR-1) on Gerenciamento de Riscos Ocupacionais (GRO) and the Programa de Gerenciamento de Riscos (PGR). The MTE has published a Manual do GRO/PGR (2026), a guide on psychosocial risk factors related to work (2025) and questions and answers on Chapter 1.5 of NR-1 (first round dated 30 April 2026). The documents do not mention ISO 45001. | |
| Ibama and the environmental bodies of the Union, the states and the municipalities Industry, mining, energy, infrastructure and any activity that uses environmental resources or may pollute | Law No. 6,938 of 31 August 1981 (National Environment Policy) and Law No. 15,190 of 8 August 2025, the Lei Geral do Licenciamento Ambiental, which sets general rules for licensing activities that use environmental resources or may pollute or degrade the environment. An ISO 14001 certificate does not replace an environmental licence. | |
| Federal Executive, with Inmetro in conformity assessment Manufacturers and importers of machines and appliances that consume energy | Law No. 10,295 of 17 October 2001, the National Policy on Conservation and Rational Use of Energy, under which the Executive sets maximum specific energy consumption or minimum energy efficiency levels for machines and appliances made or sold in Brazil. It does not set an energy management system requirement. | |
| Agência Nacional de Proteção de Dados (ANPD) Software, data and digital service companies that use artificial intelligence | The ANPD's site reports a regulatory sandbox on artificial intelligence and publishes its monitoring reports. The LGPD gives data subjects the right to request review of decisions taken solely on automated processing of personal data that affect their interests. Neither makes an AI management system certificate mandatory. |
Accreditation and recognition
- Coordenação-Geral de Acreditação (Cgcre) of Inmetro: National accreditation body; Inmetro's pages list its accredited testing and calibration laboratories (ABNT NBR ISO/IEC 17025:2017) and clinical laboratories (ABNT NBR ISO 15189:2022), and its programmes for management system certification bodies covering quality, environment, food safety, anti-bribery, social responsibility, medical devices and civil construction.
- Associação Brasileira de Normas Técnicas (ABNT): National standards body, not an accreditation body; it publishes Brazilian adoptions of standards under designations such as ABNT NBR ISO, the form Cgcre's pages use for ISO/IEC 17025 and ISO 15189.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public tenders and administrative contracts (Law No. 14,133 of 1 April 2021 (new law on tenders and administrative contracts), applied by each contracting body): For contracts of very large value the notice must require the winning bidder to implement an integrity programme, and having an integrity programme is a tie-break criterion and a factor when penalties are set. The Law does not set a general ISO certificate requirement, and qualification criteria are written in each notice.
- National register of punished companies (CNEP) (Federal Executive, under Law No. 12,846 of 2013): The register gives public notice of sanctions applied to legal entities under the Anti-Corruption Law by bodies of all branches and levels of government; it is a check buyers can make, not a certificate.
Economic zones
- Zona Franca de Manaus: industrial, commercial, agricultural
- Zonas de Processamento de Exportação (ZPE): export-oriented manufacturing and services
Sterling in Brazil
Sterling delivers in Brazil from its New York office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Brazil, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Brazilian clients ask
Is the LGPD in force, and who enforces it?
Yes. Law No. 13,709 of 2018 is Brazil's general data protection law, and the Agência Nacional de Proteção de Dados enforces it. Its administrative sanctions provisions took effect on 1 August 2021, according to Planalto's compiled text. It can reach foreign companies that offer goods or services to people in Brazil. Confirm how it applies to you with counsel or the ANPD.
What is the legal status of the ANPD?
Planalto's text of the LGPD describes it as the Agência Nacional de Proteção de Dados, a special-nature autarchy linked to the Ministry of Justice and Public Security, with its own technical, decision-making and financial autonomy. Law No. 14,460 of 2022 first made the authority an autarchy, and Law No. 15,352 of 2026 recast it as an agency. Check the current text of the Law for any later change.
Which body accredits certification bodies in Brazil?
The Coordenação-Geral de Acreditação, known as Cgcre, a unit of Inmetro. Global ACI lists it as a Full Member and MRA signatory, with recognised scopes that include ISO 9001, ISO 14001, ISO/IEC 27001, ISO 45001 and ISO/IEC 17025. Inmetro advises confirming a body's accredited scope in its databases, because scopes can be cancelled, so ask for the current certificate.
Do Brazilian financial regulators require ISO 27001?
Not by name. Resolução CMN nº 4.893 and Resolução BCB nº 85 require institutions to keep a cybersecurity policy, handle incidents, test continuity scenarios and perform due diligence on providers of data processing and cloud services, but neither text names ISO/IEC 27001 or PCI DSS. An ISO 27001 certificate remains a common way to evidence controls. Ask your supervisor or counterparty what it accepts.
Do Brazilian public tenders require ISO certificates?
Not as a general rule. Law No. 14,133 of 2021 leaves qualification criteria to each notice, but it requires an integrity programme from the winner of very large contracts and treats having one as a tie-break criterion and a penalty factor. Read the notice for the contract you want, and consider ISO 37001 or ISO 37301 as a framework for the programme.
Are certification audits in Brazil conducted in Portuguese?
Often, yes. Portuguese is the official language and regulators, contracts and audit records normally use it, though many multinationals and software firms work in English. The audit language is agreed with the certification body at application, together with any interpreter and the language of controlled documents. Say early if shop-floor interviews will be in Portuguese and reports in English.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Lei Geral de Proteção de Dados Pessoais (LGPD) — General Personal Data Protection Law — planalto.gov.br (accessed 11 Oct 2026)
- Agência Nacional de Proteção de Dados (ANPD) — legal form and regulations — planalto.gov.br; gov.br (accessed 11 Oct 2026)
- Estatuto Digital da Criança e do Adolescente (Law No. 15,211 of 17 September 2025) — planalto.gov.br; gov.br (accessed 11 Oct 2026)
- Resolução CMN nº 4.893 of 26 February 2021 and Resolução BCB nº 85 of 8 April 2021 on the cybersecurity policy and on the requirements for contracting data processing, data storage and cloud computing services; the CMN text applies to institutions authorised by the Banco Central, and the BCB text to payment institutions, securities brokers and distributors and exchange brokers. They require a cybersecurity policy, incident handling, continuity-test scenarios and due diligence on service providers. Neither text names ISO/IEC 27001 or PCI DSS. — bcb.gov.br (accessed 11 Oct 2026)
- Law No. 12,846 of 1 August 2013 (Lei Anticorrupção) on the administrative and civil liability of legal entities for acts against the public administration, and Decree No. 11,129 of 11 July 2022, which regulates it and defines an integrity programme as internal integrity, audit and whistleblowing mechanisms and the effective application of codes of ethics and conduct. The Law lists the existence of such mechanisms among the factors considered when applying sanctions, and creates the Cadastro Nacional de Empresas Punidas (CNEP). — planalto.gov.br (accessed 11 Oct 2026)
- Law No. 9,782 of 26 January 1999, which defines the National Health Surveillance System and creates Anvisa. Anvisa issues Certificates of Good Manufacturing Practices (CBPF) and of Good Distribution and Storage Practices (CBPDA) and publishes lists of certified companies, including for health products; its site also carries a MDSAP topic. A management system certificate does not replace Anvisa's registration or good practice certificates. — planalto.gov.br; gov.br (accessed 11 Oct 2026)
- MAPA's site carries sections on the inspection of products of animal origin and of plant origin and on agro-industry. Inspection services and sanitary rules apply to the plant and the product; a food safety certificate does not replace them. — gov.br (accessed 11 Oct 2026)
- Norma Regulamentadora nº 1 (NR-1) on Gerenciamento de Riscos Ocupacionais (GRO) and the Programa de Gerenciamento de Riscos (PGR). The MTE has published a Manual do GRO/PGR (2026), a guide on psychosocial risk factors related to work (2025) and questions and answers on Chapter 1.5 of NR-1 (first round dated 30 April 2026). The documents do not mention ISO 45001. — gov.br (accessed 11 Oct 2026)
- Law No. 6,938 of 31 August 1981 (National Environment Policy) and Law No. 15,190 of 8 August 2025, the Lei Geral do Licenciamento Ambiental, which sets general rules for licensing activities that use environmental resources or may pollute or degrade the environment. An ISO 14001 certificate does not replace an environmental licence. — planalto.gov.br; gov.br (accessed 11 Oct 2026)
- Law No. 10,295 of 17 October 2001, the National Policy on Conservation and Rational Use of Energy, under which the Executive sets maximum specific energy consumption or minimum energy efficiency levels for machines and appliances made or sold in Brazil. It does not set an energy management system requirement. — planalto.gov.br (accessed 11 Oct 2026)
- The ANPD's site reports a regulatory sandbox on artificial intelligence and publishes its monitoring reports. The LGPD gives data subjects the right to request review of decisions taken solely on automated processing of personal data that affect their interests. Neither makes an AI management system certificate mandatory. — gov.br; planalto.gov.br (accessed 11 Oct 2026)
- Coordenação-Geral de Acreditação (Cgcre) of Inmetro — global-aci.org; gov.br (accessed 11 Oct 2026)
- Associação Brasileira de Normas Técnicas (ABNT) — abnt.org.br; gov.br (accessed 11 Oct 2026)
- Public tenders and administrative contracts — planalto.gov.br (accessed 11 Oct 2026)
- National register of punished companies (CNEP) — planalto.gov.br (accessed 11 Oct 2026)
- Zona Franca de Manaus — planalto.gov.br; gov.br (accessed 11 Oct 2026)
- Zonas de Processamento de Exportação (ZPE) — planalto.gov.br (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the New York team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice