Where we work · Burundi
ISO and GRC certification consulting in Burundi
Achieve ISO and GRC certification in Burundi with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Nairobi office team
- Effivity and Academy included
Sectors that ask for certification in Burundi
Clients include
ISO and GRC certification in Burundi at a glance
Burundi's compliance agenda now has a new anchor in a data protection statute. Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel provides for an Agence de protection des données à caractère personnel and obliges larger controllers to register, appoint a data protection officer and assess impact. Beside it sit the medicines and food regulator ABREMA (Autorité Burundaise de Régulation des Médicaments à usage humain et des Aliments), the national standards body BBN (Bureau Burundais de Normalisation et Contrôle de la Qualité), which publishes a list of mandatory product standards, and the Agence de Développement du Burundi, which runs investment code incentives. Buyers include coffee and tea exporters, agri-food processors, miners, banks and microfinance lenders, telecom and ICT firms, hotels and public-sector suppliers. Certification is granted by accredited certification bodies, whose accreditation for Burundian organisations usually comes from another economy within the international arrangements. Sterling serves clients across Burundi from its Nairobi office, on site where the work needs it and remotely otherwise, drawing on 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Burundi
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Burundi (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel Agence de protection des données à caractère personnel, the body the law names to oversee its application; a decree is to set its missions, composition, organisation and operation | Applies to automated and non-automated processing of personal data by individuals, the State, local authorities and public or private legal persons, and to controllers or processors established abroad that use means of processing located in Burundi. It sets principles of fair, lawful and transparent processing, a list of lawful grounds including consent and contract, privacy by design and by default, a general ban on sensitive data with listed exceptions, information duties, rights to object, access, rectify, erase and port data, rules on automated decisions and artificial intelligence, written processor contracts, security measures and notification of personal data breaches to the authority and to affected people. Transfers abroad are allowed to states that an order of the minister in charge of the digital economy is to list as adequate, or under safeguards the authority approves. Larger controllers (including employers above a stated headcount and public bodies) must register, keep a record of processing, appoint a data protection officer and carry out impact assessments. Transition periods differ for public bodies and for other controllers. | |
| Loi n°1/10 du 16 mars 2022 portant prévention et répression de la cybercriminalité au Burundi and Loi n°1/22 du 22 août 2024 portant Code des communications électroniques et postales Agence de Régulation et de Contrôle des Télécommunications (ARCT) publishes the texts; enforcement bodies as the laws provide | Context for security duties: the cybercrime law deals with offences committed through information technology and the communications code governs electronic communications and postal services, while the data protection law sets the operating duties of organisations that process personal data. | |
| Autorité Burundaise de Régulation des Médicaments à usage humain et des Aliments (ABREMA) Medicines and foods: importers, manufacturers, wholesalers and pharmacies | State administration under the ministry in charge of public health, governed by Loi N°1/11 du 08 mai 2020 portant Réglementation de l'exercice de la Pharmacie et du Médicament à usage humain and created by Décret N° 100/039 du 26 février 2021. Its stated aim is to protect public health by promoting the quality and safety of medicines and foods on Burundian territory; its listed functions include product registration, inspection of establishments against good manufacturing and distribution practice, licensing of pharmaceutical establishments, import and export control, quality-control laboratory testing and vaccine batch release. ABREMA's own quality policy refers to ISO 9000, ISO 9001, ISO 9004 and ISO 26000. | ISO 9001, ISO 13485, ISO/IEC 17025, ISO 22000, HACCP |
| Bureau Burundais de Normalisation et Contrôle de la Qualité (BBN) Producers, importers and exporters of goods covered by national standards | National standards body and ISO member body. Its site states a mission to develop and publish national standards, to maintain national measurement standards and legal metrology, to run market surveillance and import inspection for products under mandatory standards, and to represent Burundi in regional and international standards organisations. An announcement of the ministry in charge of commerce dated 21 August 2014, published on BBN's site under the law on the national system of standardisation, metrology, quality assurance and testing, lists Burundian standards of mandatory application, among them wheat flour, maize, refined sugar, fresh pineapples, fruit juices, drinking water, margarine and fresh avocados. BBN also administers a pre-export conformity verification programme for imported goods. | ISO 9001, ISO/IEC 17025, ISO 22000, HACCP |
| Agence de Régulation et de Contrôle des Télécommunications (ARCT) Telecommunications, internet and ICT service providers | Regulator of the electronic communications sector under the communications code (Loi N°1/22 du 22 août 2024) and a series of decrees on operating conditions, licences, the national internet exchange point and the universal service fund; it also runs an online platform, in service since 10 November 2025, for authorisations to import and export electronic communications equipment. | ISO/IEC 27001, ISO/IEC 20000-1, ISO 22301 |
| Banque de la République du Burundi (BRB) Banks, microfinance institutions and payment service providers | Central bank whose site lists banking supervision, microfinance supervision, payment systems and consumer protection among its functions; the banking law is Loi n°1/17 du 22 août 2017 régissant les activités bancaires, and BRB publishes payment-system oversight reports and news on payment interoperability. BRB's pages do not name ISO/IEC 27001 or PCI DSS. | ISO/IEC 27001, PCI DSS, ISO 22301, SOC 2 |
| Agence de Développement du Burundi (ADB), created by Décret n° 100/255 du 15 novembre 2021 Investors, new projects and hotel developments | Investment code (Loi n°1/24 du 10 septembre 2008, as modified by Loi n°1/19 du 17 juin 2021) with tax, customs and non-tax incentives for projects in priority sectors: agriculture, energy, health, tourism, education, technology, mines, industry and financial services. Eligibility requires compliance with Burundian laws, notably on environmental protection, labour and insurance, and, depending on the project, an environmental conformity certificate and an operating licence. For hotel projects ADB lists physical requirements, among them separate stock areas for perishable and non-perishable goods, space for waste bins and a grease trap separate from the septic tank. | ISO 14001, ISO 45001, ISO 22000, HACCP |
| Ministry in charge of mineral resources, energy, industry, commerce and tourism (MRMEICT) under the Mining Code Mining and quarrying operators | Loi n°1/19 du 04 août 2023 modifying Loi n°1/21 du 15 octobre 2013 on the Mining Code, with Décret n°100/224 du 23 novembre 2023 on artisanal, semi-mechanised and mechanised mines and quarries, as listed on ADB's regulation page; ADB's mining page describes industrial exploitation permits and artisanal exploitation by mining cooperatives. | ISO 45001, ISO 14001, ISO 9001 |
| Authorities named in each law (labour, environment and electricity) Employers, environmental management and electricity | Loi n°1/11 du 24 novembre 2020 revising the labour code, Loi n°1/09 du 25 mai 2021 modifying the environment code and Loi n°1/013 du 23 avril 2015 reorganising the electricity sector, all listed on ADB's regulation page; none of the listings states that it requires a management system standard. | ISO 45001, ISO 14001, ISO 50001 |
| Presidency of the Republic (national anti-corruption strategy) and the Autorité de Régulation des Marchés Publiques (ARMP) for procurement Public bodies and companies exposed to bribery risk | The Presidency's site reports that the head of state launched the implementation of the national strategy against corruption (news item dated 10 October 2026); the public procurement code is Loi N° 1/01 du 04 février 2008, modified by Loi N° 1/04 du 29 janvier 2018, as ARMP lists it. Neither source names ISO 37001 or ISO 37301. | ISO 37001, ISO 37301 |
Accreditation and recognition
- Kenya National Accreditation Service (KENAS): Foreign accreditation body that BBN's site names as having carried out a periodic evaluation of BBN services in March 2025.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Public Procurement Code (Autorité de Régulation des Marchés Publiques (ARMP)): ARMP states a mission to ensure free access and genuine competition for private and public enterprises in public procurement and publishes procurement notices, annual procurement plans, appeal decisions and standard bidding documents. Quality or security certificates matter only where an individual bidding document sets them.
Economic zones
- Warubondo special economic zone:
Sterling in Burundi
Sterling delivers in Burundi from its Nairobi office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Burundi clients ask
Does Burundi have a personal data protection law?
Yes. Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel appears on the National Assembly's list of laws promulgated in 2026, and it enters into force on the day of promulgation. It names an Agence de protection des données à caractère personnel to oversee it, with its missions and organisation to be set by decree. Ask counsel how the transition periods apply to you.
Which Burundian organisations must register and appoint a data protection officer?
Larger controllers, which the law calls major controllers. They include employers above a stated headcount, public authorities and bodies that routinely handle data needed to protect life, support litigation or run emergency medical care. They register with the data protection authority, keep a record of processing, designate a data protection officer and carry out impact assessments. Smaller organisations may appoint an officer voluntarily; confirm your category with counsel.
Which authority regulates medicines and foods in Burundi?
ABREMA, the Autorité Burundaise de Régulation des Médicaments à usage humain et des Aliments, created by decree in 2021 under the ministry in charge of public health. Its functions include product registration, inspection against good manufacturing and distribution practice, licensing of pharmaceutical establishments, import and export control and laboratory testing. Check the current texts on its site for the product you handle before planning a quality system.
What does the national standards body do, and are any standards mandatory?
BBN develops and publishes Burundian standards, maintains measurement standards and runs market surveillance and import inspection. A ministerial announcement published on its site lists standards of mandatory application, including wheat flour, maize, sugar, drinking water and several fruit products. Management system certificates come from accredited certification bodies, not from BBN, so confirm product requirements with BBN directly.
Which accreditation do certificates for Burundian organisations usually carry?
In practice the accreditor sits in another economy and operates within the international mutual recognition arrangements. One public example: BBN's news item records Kenya's national accreditation service assessing BBN services in March 2025. When you choose a certification body, request its accreditation certificate, read the scope line for your standard and ask your buyer or regulator whether it accepts that accreditor.
Which language are audits in Burundi conducted in?
French or Kirundi, chosen according to the site and the people being interviewed. Kirundi is the national language under the Constitution, every legislative text must exist in Kirundi, and the data protection law appears in French and Kirundi. Fix the audit language, interpreter arrangements and the language of controlled documents with the certification body at application, so the auditor can read your evidence.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel — arct.gov.bi; assemblee.bi (accessed 18 Oct 2026)
- Loi n°1/10 du 16 mars 2022 portant prévention et répression de la cybercriminalité au Burundi and Loi n°1/22 du 22 août 2024 portant Code des communications électroniques et postales — arct.gov.bi (accessed 18 Oct 2026)
- State administration under the ministry in charge of public health, governed by Loi N°1/11 du 08 mai 2020 portant Réglementation de l'exercice de la Pharmacie et du Médicament à usage humain and created by Décret N° 100/039 du 26 février 2021. Its stated aim is to protect public health by promoting the quality and safety of medicines and foods on Burundian territory; its listed functions include product registration, inspection of establishments against good manufacturing and distribution practice, licensing of pharmaceutical establishments, import and export control, quality-control laboratory testing and vaccine batch release. ABREMA's own quality policy refers to ISO 9000, ISO 9001, ISO 9004 and ISO 26000 — abrema.gov.bi (accessed 18 Oct 2026)
- National standards body and ISO member body. Its site states a mission to develop and publish national standards, to maintain national measurement standards and legal metrology, to run market surveillance and import inspection for products under mandatory standards, and to represent Burundi in regional and international standards organisations. An announcement of the ministry in charge of commerce dated 21 August 2014, published on BBN's site under the law on the national system of standardisation, metrology, quality assurance and testing, lists Burundian standards of mandatory application, among them wheat flour, maize, refined sugar, fresh pineapples, fruit juices, drinking water, margarine and fresh avocados. BBN also administers a pre-export conformity verification programme for imported goods — bbnburundi.org; iso.org (accessed 18 Oct 2026)
- Regulator of the electronic communications sector under the communications code (Loi N°1/22 du 22 août 2024) and a series of decrees on operating conditions, licences, the national internet exchange point and the universal service fund; it also runs an online platform, in service since 10 November 2025, for authorisations to import and export electronic communications equipment — arct.gov.bi (accessed 18 Oct 2026)
- Central bank whose site lists banking supervision, microfinance supervision, payment systems and consumer protection among its functions; the banking law is Loi n°1/17 du 22 août 2017 régissant les activités bancaires, and BRB publishes payment-system oversight reports and news on payment interoperability. BRB's pages do not name ISO/IEC 27001 or PCI DSS — brb.bi; investburundi.bi (accessed 18 Oct 2026)
- Investment code (Loi n°1/24 du 10 septembre 2008, as modified by Loi n°1/19 du 17 juin 2021) with tax, customs and non-tax incentives for projects in priority sectors: agriculture, energy, health, tourism, education, technology, mines, industry and financial services. Eligibility requires compliance with Burundian laws, notably on environmental protection, labour and insurance, and, depending on the project, an environmental conformity certificate and an operating licence. For hotel projects ADB lists physical requirements, among them separate stock areas for perishable and non-perishable goods, space for waste bins and a grease trap separate from the septic tank — investburundi.bi (accessed 18 Oct 2026)
- Loi n°1/19 du 04 août 2023 modifying Loi n°1/21 du 15 octobre 2013 on the Mining Code, with Décret n°100/224 du 23 novembre 2023 on artisanal, semi-mechanised and mechanised mines and quarries, as listed on ADB's regulation page; ADB's mining page describes industrial exploitation permits and artisanal exploitation by mining cooperatives — investburundi.bi; mctit.gov.bi (accessed 18 Oct 2026)
- Loi n°1/11 du 24 novembre 2020 revising the labour code, Loi n°1/09 du 25 mai 2021 modifying the environment code and Loi n°1/013 du 23 avril 2015 reorganising the electricity sector, all listed on ADB's regulation page; none of the listings states that it requires a management system standard — investburundi.bi (accessed 18 Oct 2026)
- The Presidency's site reports that the head of state launched the implementation of the national strategy against corruption (news item dated 10 October 2026); the public procurement code is Loi N° 1/01 du 04 février 2008, modified by Loi N° 1/04 du 29 janvier 2018, as ARMP lists it. Neither source names ISO 37001 or ISO 37301 — presidence.gov.bi; armp.gov.bi (accessed 18 Oct 2026)
- Kenya National Accreditation Service (KENAS) — bbnburundi.org (accessed 18 Oct 2026)
- Public procurement under the Public Procurement Code — armp.gov.bi (accessed 18 Oct 2026)
- Warubondo special economic zone — investburundi.bi (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Nairobi team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Nairobi office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice