Where we work · Cabo Verde
ISO and GRC certification consulting in Cabo Verde
Achieve ISO and GRC certification in Cabo Verde with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Johannesburg office team
- Effivity and Academy included
Sectors that ask for certification in Cabo Verde
Clients include
ISO and GRC certification in Cabo Verde at a glance
Hotel groups in the tourism development zones, fish and food processors, construction firms and public suppliers all face the same buyer question in Cabo Verde: how is the work controlled? Demand for ISO and GRC work follows the rules already in place. The Entidade Reguladora Independente da Saúde issues the sanitary licence for food establishments and runs a national sampling plan. The Comissão Nacional de Proteção de Dados supervises the personal data regime of Lei n.º 133/V/2001, amended and republished in 2021, while Decreto-lei n.º 9/2021 sets the cybersecurity regime under the Centro Nacional de Cibersegurança. Public tenders follow the Código da Contratação Pública overseen by ARAP, and Cabo Verde TradeInvest promotes investment, including the international business centre created by Decreto-Lei n.º 57/2017. IGQPI is the national contact for standards. Certificates come from accredited certification bodies, never from Sterling. Sterling's Johannesburg office serves clients across Cabo Verde, drawing on 8,100+ client engagements in 60+ countries, 20+ years of practice, and Effivity and Sterling Academy included with every engagement.
ISO and GRC standards Sterling delivers in Cabo Verde
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Cabo Verde (9)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General legal regime for the protection of personal data of natural persons (Regime Jurídico Geral de Protecção de Dados Pessoais das Pessoas Singulares) Comissão Nacional de Proteção de Dados (CNPD), an independent administrative authority created under Lei n.º 42/VIII/2013, de 17 de setembro, as amended by Lei n.º 120/IX/2021, which operates alongside the National Assembly | Applies to automated and non-automated processing of personal data in a filing system, to controllers and processors established in Cabo Verde, and to controllers outside the country that process data of people located in Cabo Verde when offering goods or services or monitoring behaviour; it excludes purely personal or household activity. The republished regime sets principles of lawfulness, purpose limitation and minimisation, legitimacy conditions, consent conditions (with guardian consent for those under sixteen), a right of information, access, rectification, erasure, portability, limitation and objection, rules on automated individual decisions and profiling, security and data protection by design, breach notification to the CNPD within 72 hours unless the breach is unlikely to put rights at risk, impact assessments, designation of a data protection officer in listed cases, transfer rules, and notification or authorisation of processing by the CNPD. | |
| CNPD supervision, authorisations and guidance Comissão Nacional de Proteção de Dados (CNPD) | The CNPD describes itself as the independent administrative entity responsible for monitoring compliance with data protection rules; its functions include supervision, authorising and regulating processing (including international transfers and interconnection of databases), issuing opinions on draft legislation, public awareness and cooperation with foreign authorities. Its site carries pages for complaints, information requests, data breach and obligations of organisations, all in Portuguese. | |
| Entidade Reguladora Independente da Saúde (ERIS) Food establishments and food safety, medicines, medical devices and health care providers | ERIS's statutes are in Decreto-Lei n.º 03/2019, de 10 de janeiro (B.O. n.º 03/2019, I Série, 1.º Suplemento). Under them ERIS grants the sanitary licence for food establishments as a prerequisite of the commercial or industrial activity licence, supervises regulated establishments, can carry out inquiries or audits, and applies administrative penalties. It monitors the market through the national food sampling plan (PNCA) introduced in 2015, which combines laboratory analysis (microbiology and physico-chemistry) with labelling checks on a risk basis. Food safety rests on Decreto-Legislativo n.º 03/2009, de 15 de junho, with general hygiene rules in Decreto-Lei n.º 25/2009 and the national food control system in Decreto-Lei n.º 33/2016, all listed on ERIS's food-safety page. ERIS's pages do not name HACCP or ISO 22000. | |
| Centro Nacional de Cibersegurança, the national cybersecurity authority, with the CSIRT.CV incident response team under it Public administration, critical-infrastructure operators, essential-service operators (energy, transport, banking and market infrastructure, health, drinking water, digital infrastructure) and digital service providers | Decreto-lei n.º 9/2021, de 29 de janeiro (B.O. I Série n.º 9), which approves the cybersecurity legal regime and adopts ECOWAS Directive C/DIR. 1/08/11. Public bodies and critical-infrastructure operators must apply appropriate and proportionate technical and organisational measures; essential-service operators register formally with the CSIRT.CV; digital service providers must manage risks to their systems, taking into account system security, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards, and must notify substantial incidents to the Centro. Security requirements are to be written so that internationally accepted standards can be used without favouring one technology. Decreto-Regulamentar n.º 1/2021 creates the CSIRT.CV. | |
| Auditoria Geral do Mercado de Valores Mobiliários (AGMVM) Securities market participants | AGMVM describes itself as the Cabo Verdean authority for regulation, supervision and promotion of the securities market, instituted by Decreto-Legislativo n.º 52/V/98, de 11 de maio, working under the Governor of the Banco de Cabo Verde with administrative and functional autonomy. It regulates securities, financial instruments and public offers and supervises the entities under it. Its pages do not cite a management-system standard. | |
| Agência de Regulação Multissectorial da Economia (ARME) Electronic communications, postal services, electricity and fuels | ARME's site is organised by regulated sector: electronic communications, postal services and energy (fuels and electricity), each with its regulations, regulatory decisions, tariffs and list of regulated operators. The pages do not cite a management-system standard. | |
| Agência de Aviação Civil (AAC) Civil aviation: operators, aerodromes, air navigation, maintenance organisations and training organisations | The AAC's site groups its work by aeronautical personnel, air operators (national and international), ground handling, security and facilitation, aerodromes, air navigation, maintenance organisations and training organisations, and publishes consultations, circulars and monthly statistics. Its pages do not cite AS9100 or ISO 9001. | |
| The Environmental Authority, a central service defined in Decreto-lei n.º 23/2023 Industry, tourism, energy and other activities with environmental effects | Decreto-lei n.º 23/2023, de 29 de agosto (B.O. I Série n.º 91), creates strategic environmental and social assessment of plans and programmes in farming, fisheries, energy, industry, tourism, transport, water and waste. It recites the Bases da Política do Ambiente (Lei n.º 86/IV/93, de 26 de julho, as amended by Lei n.º 23/X/2023, de 18 de abril) and the environmental impact assessment regime of Decreto-Lei n.º 27/2020, de 19 de março, which applies to projects. | |
| The labour authorities under the Cabo Verdean Labour Code All employers | Código Laboral Cabo-verdiano, approved by Decreto-Legislativo n.º 5/2007, de 16 de outubro, amended by Decreto-Legislativo n.º 5/2010 and by Decreto-Regulamentar n.º 1/2016, which refers to employers' occupational safety and health services and to their annual activity report. The Code is not recorded as citing ISO 45001. |
Accreditation and recognition
- Instituto de Gestão da Qualidade e da Propriedade Intelectual (IGQPI): National quality and intellectual property institute: its site shows it selling standards, publishing normative documents for public consultation on the way to Cabo Verdean standards, and controlling pre-packaged goods under legal metrology. Standards and metrology role only; it is not an accreditation body.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Código da Contratação Pública (Lei n.º 88/VIII/2015, de 14 de abril) and the Autoridade Reguladora das Aquisições Públicas (ARAP) (ARAP, whose site lists consultative, audit, regulatory, training and accreditation, information, tax, enforcement and appeal functions and publishes the Código, studies on direct award and a code of conduct for those in the public procurement system): ARAP's pages publish the Code and guidance but state no general ISO certification requirement. Each tender sets its own qualification evidence in its documents, so read the qualification and evaluation clauses of the tender in question.
Economic zones
- Centro Internacional de Negócios de Cabo Verde (CIN-CV): industry, trade, services
- Industrial zones and the Lazareto industrial park: manufacturing, food processing, construction materials, services
- Integrated tourism development zones (ZDTI): tourism, hospitality, real estate
Sterling in Cabo Verde
Sterling delivers in Cabo Verde from its Johannesburg office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Cabo Verde clients ask
Does Cabo Verde have a personal data protection law?
Yes. The general regime was approved by Lei n.º 133/V/2001 and has been amended by Lei n.º 41/VIII/2013 and Lei n.º 121/IX/2021, which republished it in full in March 2021. The Comissão Nacional de Proteção de Dados supervises it, and it can reach foreign controllers that process data of people in Cabo Verde. Confirm how it applies to you with your counsel or the CNPD.
Who supervises food businesses in Cabo Verde?
The Entidade Reguladora Independente da Saúde grants the sanitary licence that food establishments need before their commercial or industrial licence, and it monitors the market through a national sampling plan with laboratory analysis and labelling checks. Its pages list the food safety and hygiene decrees. Ask ERIS which licence and rules apply to your activity.
Is there a cybersecurity law that Cabo Verde businesses must follow?
Yes. Decreto-lei n.º 9/2021 sets the cybersecurity regime for public bodies, critical-infrastructure and essential-service operators and digital service providers, under the Centro Nacional de Cibersegurança and the CSIRT.CV. Digital service providers must manage system security, incident handling and continuity, and notify substantial incidents. Check with your counsel which category your organisation falls into.
Do Cabo Verde public tenders require an ISO certificate?
Not as a general rule. The Código da Contratação Pública, approved by Lei n.º 88/VIII/2015, and the ARAP pages that publish it state no blanket ISO requirement. Each tender sets its own qualification evidence, so read the qualification and evaluation clauses of the documents and put your question to the procuring entity or ARAP.
In which language are audits and documents handled in Cabo Verde?
Article 9 of the Constitution makes Portuguese the official language, and laws, licences and guidance from the CNPD and ERIS are published in it. Expect audits in Portuguese, with staff interviews in Creole if they prefer. Settle the working language, interpreter needs and controlled-document language with your certification body when applying.
Is there a Cabo Verde body that accredits certification bodies?
The national institute IGQPI is the contact for standards: it sells them and puts draft normative documents out for public consultation, but it is a standards and metrology body. For accreditation, Cabo Verde clients usually rely on a body abroad within the international arrangements. Ask your certification body to show its accreditation certificate and scope.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General legal regime for the protection of personal data of natural persons (Regime Jurídico Geral de Protecção de Dados Pessoais das Pessoas Singulares) — cnpd.cv (accessed 18 Oct 2026)
- CNPD supervision, authorisations and guidance — cnpd.cv (accessed 18 Oct 2026)
- ERIS's statutes are in Decreto-Lei n.º 03/2019, de 10 de janeiro (B.O. n.º 03/2019, I Série, 1.º Suplemento). Under them ERIS grants the sanitary licence for food establishments as a prerequisite of the commercial or industrial activity licence, supervises regulated establishments, can carry out inquiries or audits, and applies administrative penalties. It monitors the market through the national food sampling plan (PNCA) introduced in 2015, which combines laboratory analysis (microbiology and physico-chemistry) with labelling checks on a risk basis. Food safety rests on Decreto-Legislativo n.º 03/2009, de 15 de junho, with general hygiene rules in Decreto-Lei n.º 25/2009 and the national food control system in Decreto-Lei n.º 33/2016, all listed on ERIS's food-safety page. ERIS's pages do not name HACCP or ISO 22000. — eris.cv (accessed 18 Oct 2026)
- Decreto-lei n.º 9/2021, de 29 de janeiro (B.O. I Série n.º 9), which approves the cybersecurity legal regime and adopts ECOWAS Directive C/DIR. 1/08/11. Public bodies and critical-infrastructure operators must apply appropriate and proportionate technical and organisational measures; essential-service operators register formally with the CSIRT.CV; digital service providers must manage risks to their systems, taking into account system security, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards, and must notify substantial incidents to the Centro. Security requirements are to be written so that internationally accepted standards can be used without favouring one technology. Decreto-Regulamentar n.º 1/2021 creates the CSIRT.CV. — boe.incv.cv (accessed 18 Oct 2026)
- AGMVM describes itself as the Cabo Verdean authority for regulation, supervision and promotion of the securities market, instituted by Decreto-Legislativo n.º 52/V/98, de 11 de maio, working under the Governor of the Banco de Cabo Verde with administrative and functional autonomy. It regulates securities, financial instruments and public offers and supervises the entities under it. Its pages do not cite a management-system standard. — agmvm.cv (accessed 18 Oct 2026)
- ARME's site is organised by regulated sector: electronic communications, postal services and energy (fuels and electricity), each with its regulations, regulatory decisions, tariffs and list of regulated operators. The pages do not cite a management-system standard. — arme.cv (accessed 18 Oct 2026)
- The AAC's site groups its work by aeronautical personnel, air operators (national and international), ground handling, security and facilitation, aerodromes, air navigation, maintenance organisations and training organisations, and publishes consultations, circulars and monthly statistics. Its pages do not cite AS9100 or ISO 9001. — aac.cv (accessed 18 Oct 2026)
- Decreto-lei n.º 23/2023, de 29 de agosto (B.O. I Série n.º 91), creates strategic environmental and social assessment of plans and programmes in farming, fisheries, energy, industry, tourism, transport, water and waste. It recites the Bases da Política do Ambiente (Lei n.º 86/IV/93, de 26 de julho, as amended by Lei n.º 23/X/2023, de 18 de abril) and the environmental impact assessment regime of Decreto-Lei n.º 27/2020, de 19 de março, which applies to projects. — boe.incv.cv (accessed 18 Oct 2026)
- Código Laboral Cabo-verdiano, approved by Decreto-Legislativo n.º 5/2007, de 16 de outubro, amended by Decreto-Legislativo n.º 5/2010 and by Decreto-Regulamentar n.º 1/2016, which refers to employers' occupational safety and health services and to their annual activity report. The Code is not recorded as citing ISO 45001. — boe.incv.cv (accessed 18 Oct 2026)
- Instituto de Gestão da Qualidade e da Propriedade Intelectual (IGQPI) — igqpi.cv (accessed 18 Oct 2026)
- Código da Contratação Pública (Lei n.º 88/VIII/2015, de 14 de abril) and the Autoridade Reguladora das Aquisições Públicas (ARAP) — arap.cv (accessed 18 Oct 2026)
- Centro Internacional de Negócios de Cabo Verde (CIN-CV) — cvtradeinvest.cv (accessed 18 Oct 2026)
- Industrial zones and the Lazareto industrial park — cvtradeinvest.cv (accessed 18 Oct 2026)
- Integrated tourism development zones (ZDTI) — cvtradeinvest.cv (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice