Where we work · Burkina Faso
ISO and GRC certification consulting in Burkina Faso
Achieve ISO and GRC certification in Burkina Faso with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in Burkina Faso
- Gold and other mining operators and their contractors
- Cotton, cashew and mango exporters and agro-processors
- Water, edible-oil and other food producers
- Banks, payment and mobile-money firms in the UEMOA
- Telecom, software and outsourced-service companies
- Pharmaceutical and health-product makers and distributors
Clients include
ISO and GRC certification in Burkina Faso at a glance
Burkina Faso's rules on privacy, information security and quality sit in a handful of recent texts. Loi n° 037-2026/ALP of 3 August 2026 replaces the 2021 data protection law, and the organic law of the same date names the ARCOD as the authority, with the CIL competent for pending files until it is set up. Loi n° 014-2024/ALT on information-system security adds duties on audits, incident declaration and outsourcing, the 2024 procurement law gives the ARCOP its tender rules, and the 2024 mining code asks titleholders for an approved occupational health and safety system. The ABNORM prepares national standards, while SOAC, the accreditation system for the UEMOA area, states international recognition for ISO 9001 and food safety management certification. Demand comes from mining and its contractors, cotton, cashew and mango exporters, water and edible-oil producers, banks, telecom firms and pharmaceutical producers. Sterling's Casablanca office supports Burkinabè organisations, backed by 8,100+ client engagements in 60+ countries and 20+ years of practice, with Effivity and Sterling Academy included in the engagement.
ISO and GRC standards Sterling delivers in Burkina Faso
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Burkina Faso (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi n° 037-2026/ALP du 03 août 2026 portant protection des personnes à l'égard du traitement des données à caractère personnel The law speaks of 'l'organe en charge de la protection des données à caractère personnel'. Loi organique n° 038-2026/ALP of 3 August 2026 names it the Autorité de régulation de la communication et du traitement des données à caractère personnel (ARCOD), and says the Commission de l'informatique et des libertés (CIL) stays competent for pending files until the ARCOD is effectively set up. | Covers automated and non-automated processing by controllers established in Burkina Faso, by controllers or processors outside it that process from national territory (transit data excluded), and by those who process data of people located in Burkina Faso when offering goods or services, monitoring behaviour, profiling, geolocating or running a digital platform accessible there; a representative may have to be designated. Consent is the default basis, with listed exceptions. People have rights to information, access, objection, rectification, erasure, to be forgotten and to portability, and may learn the criteria used when artificial intelligence processes their data. Controllers processing on a large scale keep a register, must notify the authority of a breach within forty-eight hours where rights are at risk, build protection in by design, assess impact for biometric, large-scale health, minors, systematic public monitoring, AI and large-scale profiling processing, and appoint a data protection officer where the nature or scale justifies it. Prior formalities are an opinion request, an authorisation or a normal or simplified declaration; private-sector genetic and biometric data, file interconnection, national identification numbers, AI-based predictive decision support and transfers abroad need authorisation, and identifiable health data is hosted on national territory unless the authority derogates. Transfers need an adequate level of protection plus listed safeguards. The authority can order a stop, lock data, fine or withdraw an authorisation after a formal notice, and decisions can be appealed to the administrative courts. Controllers get a fixed period from entry into force to comply. | |
| Loi organique n° 038-2026/ALP du 03 août 2026 portant dénomination, attributions, composition, organisation et fonctionnement de l'organe de régulation de la communication et de la protection des données à caractère personnel Autorité de régulation de la communication et du traitement des données à caractère personnel (ARCOD), an institution with legal personality and financial and management autonomy that, on personal data, takes individual decisions, issues recommendations, authorises and receives declarations, supervises transfers abroad, advises controllers and the public, and holds regulatory and sanctioning powers. | The organic law also covers the ARCOD's communication-sector remit; for personal data it lets the authority assist any data subject whatever their nationality, subject to reciprocity, and cooperate with foreign data protection authorities. Until the ARCOD is effectively set up, the CIL remains competent for pending files. | |
| The national body in charge of controlling and protecting national cyberspace, which Loi n° 014-2024/ALT says is created by decree; it issues technical approvals, accredits security auditors of critical-infrastructure organisations and receives incident declarations and audit reports Information-system security | Loi n° 014-2024/ALT du 09 juillet 2024 portant sécurité des systèmes d'information au Burkina Faso, listed among the promulgated laws on the legislature's website. Operators of information systems must keep connection and traffic metadata in Burkina Faso, install monitoring and access-control mechanisms to the national body's standards, review their security as technology and threats change, declare incidents with critical impact, map risks and incidents, and follow set requirements when outsourcing sensitive systems, including a Burkinabè-law contract with commitments on protection, auditability and reversibility. They must adopt standardised systems to identify, assess, treat and manage security risks continuously. Public and private bodies fall under a periodic security-audit regime whose types a decree sets; audit reports are confidential and copied to the national body, which may fine non-compliance. The law does not name ISO/IEC 27001. | |
| Autorité de régulation de la commande publique (ARCOP) Public procurement | Loi n° 005-2024/ALT du 20 avril 2024 portant réglementation générale de la commande publique au Burkina Faso, promulgated by Décret n° 2024-0507 of 10 May 2024. Contracting authorities must build sustainable procurement into award, performance and settlement by checking that human rights, fundamental labour standards and environmental legislation are respected; firms with a conflict of interest, those convicted of procurement offences and those excluded by a court or by the regulator cannot take part; the law defines offences including corruption, collusion, fraud and splitting of contracts. The ARCOP's site reports a national workshop on 16 October 2026 to validate the draft of an updated guide to the use of quality standards in public procurement. | |
| Agence Burkinabè de Normalisation, de la Métrologie et de la Qualité (ABNORM) Standards and the quality infrastructure | The ABNORM's own site says it was created in 2012 as a public administrative establishment under the national quality policy, from the merger of the former quality and metrology directorate with the standardisation directorate set up in 2003, and has had a representation in Bobo-Dioulasso since 2016. Its stated mission is to carry out national policy on standardisation, metrology, quality promotion and accreditation; its standards role includes preparing and disseminating national standards, technical specifications and codes of good practice, and its documents page lists arrêtés that homologate regional and international standards as national standards. Its director for standardisation is the national focal point listed by SOAC. | |
| The mines administration (the ministry in charge of mines and quarries) with the ministries in charge of the environment, health and labour Mining and quarrying | Loi n° 016-2024/ALT du 18 juillet 2024 portant code minier du Burkina Faso, and Loi n° 017-2024/ALT du 18 juillet 2024 relative au contenu local dans le secteur minier, both listed on the legislature's website. The code covers prospecting, exploration, processing, transport and sale of mineral substances and the rehabilitation and closure of mine and quarry sites. It requires work to be done so as to protect workers, subcontractors and affected communities; a titleholder must set up an occupational health and safety management system for the planned works, approved by the ministries in charge of mines, health, the environment and labour; accidents and imminent risks must be reported at once to the mines administration and the labour ministry; activities must preserve the environment, and holders of industrial mining permits must have an environmental and social audit done at regular intervals and submit the report to the environment minister. The code does not name ISO 45001 or ISO 14001. | |
| Ministère de l'Industrie, du Commerce et de l'Artisanat (MICA) Foreign trade, investment approvals and food production decisions | The ministry's site describes a special export authorisation needed for listed goods under Loi n° 012-2013/AN du 07 mai 2013 portant régime général des importations et des exportations, with the product list fixed by Décret n° 2021-1235; an approval under the investment code (Loi n° 038-2018/AN) for production, conservation, processing, services, technical training and renewable-energy activities; a production decision for packaged water and for edible oils, which follows authorisation to set up the production unit and precedes authorisation to market; and an online certificate-of-origin service. The ministry's news items include a cotton-sector support item of June 2026, and the government portal's headlines report the 2026 fruit campaign for cashew and mango. | |
| Agence nationale pour la sécurité sanitaire de l'environnement, de l'alimentation, du travail et des produits de santé (ANSSEAT), and Agence nationale de régulation pharmaceutique (ANRP) Health, food, water and medicines safety | The Ministry of Health's report of 10 January 2025 says the ANSSEAT presented its ISO 9001:2015 certificate and its ISO/IEC 17025:2017 accreditation for physico-chemical analysis of medicines, and had started accreditation processes for food quality control and for water and environment testing; its director general said such documents help it enter markets and apply to international tenders. The Ministry's pharmaceutical policy note refers to the ANRP, with which pharmaceutical production units register, and to good manufacturing practice certificates. | |
| Banque Centrale des Etats de l'Afrique de l'Ouest (BCEAO) Banks and payment systems in the West African Economic and Monetary Union | The BCEAO site lists Burkina among the member states and publishes Règlement n°15/2002/CM/UEMOA on payment systems in the member states of the UEMOA; it also publishes disciplinary communiqués of the Banking Commission of the UMOA. | |
| Autorité de Régulation des Communications Electroniques et des Postes (ARCEP) Electronic communications | The ARCEP describes itself as an independent administrative institution that regulates electronic communications networks and services; its professional pages cover licences, general authorisations, electronic certification, installer approval and equipment homologation. |
Accreditation and recognition
- Système Ouest Africain d'Accréditation (SOAC / WAAS): Regional accreditation body for the UEMOA area, listed by ILAC as covering Burkina Faso among eight economies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Loi n° 005-2024/ALT on public procurement and the ARCOP (Autorité de régulation de la commande publique (ARCOP)): The law text reviewed names no management-system certificate as a condition of bidding; each tender dossier sets its own criteria. It does tie procurement to respect for labour standards and environmental legislation, excludes bidders in a conflict of interest or convicted of procurement offences, and defines corruption offences that include a bar from public tenders for a person who offers an advantage. The ARCOP reported a workshop on 16 October 2026 to validate a draft updated guide on the use of quality standards in public procurement.
Economic zones
- Kokologho pharmaceutical technopole (project): pharmaceutical production, research and development, training and support services
Sterling in Burkina Faso
Sterling delivers in Burkina Faso from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Burkina Faso clients ask
Which law governs personal data in Burkina Faso, and who supervises it?
Loi n° 037-2026/ALP of 3 August 2026, promulgated by Décret n° 2026-1034/PF, governs it and repeals the 2021 law. The organic law of the same date names the supervisor as the Autorité de régulation de la communication et du traitement des données à caractère personnel, the ARCOD, and leaves the CIL competent for pending files until the ARCOD is set up. Check the current formalities with the authority or Burkinabè counsel.
Who accredits certification bodies for Burkina Faso companies?
SOAC, the West African Accreditation System, created under UEMOA regulations and seated in Abidjan. ILAC lists Burkina Faso among the economies it covers, and SOAC's site states international recognition since December 2023 for quality management and food safety management certification. For any other standard, ask the certification body to show its accreditation certificate and scope before you sign.
In which language are audits and documents handled in Burkina Faso?
Plan on French for the paperwork. Burkinabè statutes, decrees, regulator sites and bids appear in it, so document reviews, contracts and the bulk of interviews follow suit. At application, settle with the certification body which language the audit uses, whether an interpreter is needed and what language controlled documents take, and mention early if operators on site mainly speak a local language.
What must information-system operators do under the 2024 security law?
Loi n° 014-2024/ALT asks operators to keep connection and traffic metadata in the country, review their security, declare incidents with critical impact, map risks and incidents, and adopt standardised systems to manage security risks continuously. Outsourcing of sensitive systems needs a Burkinabè-law contract covering auditability and reversibility. Periodic security audits apply to public and private bodies; confirm which regime reaches you with counsel.
What does the mining code ask of titleholders on safety and the environment?
A titleholder must set up an occupational health and safety management system for planned works, approved by the ministries for mines, health, environment and labour, and report accidents and imminent risks at once. Industrial permit holders must commission an environmental and social audit at regular intervals and send it to the environment minister. Rehabilitation and closure fall under the code. Confirm the details for your permit with the mines administration.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi n° 037-2026/ALP du 03 août 2026 portant protection des personnes à l'égard du traitement des données à caractère personnel — cil.bf (accessed 18 Oct 2026)
- Loi organique n° 038-2026/ALP du 03 août 2026 portant dénomination, attributions, composition, organisation et fonctionnement de l'organe de régulation de la communication et de la protection des données à caractère personnel — cil.bf (accessed 18 Oct 2026)
- Loi n° 014-2024/ALT du 09 juillet 2024 portant sécurité des systèmes d'information au Burkina Faso, listed among the promulgated laws on the legislature's website. Operators of information systems must keep connection and traffic metadata in Burkina Faso, install monitoring and access-control mechanisms to the national body's standards, review their security as technology and threats change, declare incidents with critical impact, map risks and incidents, and follow set requirements when outsourcing sensitive systems, including a Burkinabè-law contract with commitments on protection, auditability and reversibility. They must adopt standardised systems to identify, assess, treat and manage security risks continuously. Public and private bodies fall under a periodic security-audit regime whose types a decree sets; audit reports are confidential and copied to the national body, which may fine non-compliance. The law does not name ISO/IEC 27001. — an.bf (accessed 18 Oct 2026)
- Loi n° 005-2024/ALT du 20 avril 2024 portant réglementation générale de la commande publique au Burkina Faso, promulgated by Décret n° 2024-0507 of 10 May 2024. Contracting authorities must build sustainable procurement into award, performance and settlement by checking that human rights, fundamental labour standards and environmental legislation are respected; firms with a conflict of interest, those convicted of procurement offences and those excluded by a court or by the regulator cannot take part; the law defines offences including corruption, collusion, fraud and splitting of contracts. The ARCOP's site reports a national workshop on 16 October 2026 to validate the draft of an updated guide to the use of quality standards in public procurement. — an.bf; arcop.bf (accessed 18 Oct 2026)
- The ABNORM's own site says it was created in 2012 as a public administrative establishment under the national quality policy, from the merger of the former quality and metrology directorate with the standardisation directorate set up in 2003, and has had a representation in Bobo-Dioulasso since 2016. Its stated mission is to carry out national policy on standardisation, metrology, quality promotion and accreditation; its standards role includes preparing and disseminating national standards, technical specifications and codes of good practice, and its documents page lists arrêtés that homologate regional and international standards as national standards. Its director for standardisation is the national focal point listed by SOAC. — abnorm.bf; soacwaas.org (accessed 18 Oct 2026)
- Loi n° 016-2024/ALT du 18 juillet 2024 portant code minier du Burkina Faso, and Loi n° 017-2024/ALT du 18 juillet 2024 relative au contenu local dans le secteur minier, both listed on the legislature's website. The code covers prospecting, exploration, processing, transport and sale of mineral substances and the rehabilitation and closure of mine and quarry sites. It requires work to be done so as to protect workers, subcontractors and affected communities; a titleholder must set up an occupational health and safety management system for the planned works, approved by the ministries in charge of mines, health, the environment and labour; accidents and imminent risks must be reported at once to the mines administration and the labour ministry; activities must preserve the environment, and holders of industrial mining permits must have an environmental and social audit done at regular intervals and submit the report to the environment minister. The code does not name ISO 45001 or ISO 14001. — an.bf (accessed 18 Oct 2026)
- The ministry's site describes a special export authorisation needed for listed goods under Loi n° 012-2013/AN du 07 mai 2013 portant régime général des importations et des exportations, with the product list fixed by Décret n° 2021-1235; an approval under the investment code (Loi n° 038-2018/AN) for production, conservation, processing, services, technical training and renewable-energy activities; a production decision for packaged water and for edible oils, which follows authorisation to set up the production unit and precedes authorisation to market; and an online certificate-of-origin service. The ministry's news items include a cotton-sector support item of June 2026, and the government portal's headlines report the 2026 fruit campaign for cashew and mango. — commerce.gov.bf; an.bf; gouvernement.gov.bf (accessed 18 Oct 2026)
- The Ministry of Health's report of 10 January 2025 says the ANSSEAT presented its ISO 9001:2015 certificate and its ISO/IEC 17025:2017 accreditation for physico-chemical analysis of medicines, and had started accreditation processes for food quality control and for water and environment testing; its director general said such documents help it enter markets and apply to international tenders. The Ministry's pharmaceutical policy note refers to the ANRP, with which pharmaceutical production units register, and to good manufacturing practice certificates. — sante.gov.bf (accessed 18 Oct 2026)
- The BCEAO site lists Burkina among the member states and publishes Règlement n°15/2002/CM/UEMOA on payment systems in the member states of the UEMOA; it also publishes disciplinary communiqués of the Banking Commission of the UMOA. — bceao.int (accessed 18 Oct 2026)
- The ARCEP describes itself as an independent administrative institution that regulates electronic communications networks and services; its professional pages cover licences, general authorisations, electronic certification, installer approval and equipment homologation. — arcep.bf (accessed 18 Oct 2026)
- Système Ouest Africain d'Accréditation (SOAC / WAAS) — soacwaas.org; ilac.org (accessed 18 Oct 2026)
- Loi n° 005-2024/ALT on public procurement and the ARCOP — an.bf; arcop.bf (accessed 18 Oct 2026)
- Kokologho pharmaceutical technopole (project) — sante.gov.bf (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice