Where we work · Central African Republic
ISO and GRC certification consulting in Central African Republic
Achieve ISO and GRC certification in Central African Republic with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in Central African Republic
- Mining and quarrying operators and their contractors
- Timber and forest-products operators
- Agriculture and agri-food processors (cotton, coffee, cassava)
- Banks, microfinance and payment firms in the CEMAC system
- Telecommunications and digital service providers
- Contractors and suppliers bidding for public and externally financed contracts
Clients include
ISO and GRC certification in Central African Republic at a glance
Central African organisations meet standards through a short list of concrete texts. Loi n° 24.001 on the protection of personal data asks for a lawful ground for processing, a data protection officer and controls on transfers abroad, and it provides for an independent agency to supervise it. Banks follow COBAC regulations published by the Bank of Central African States, including those on business continuity, internal control and payment services, and the BEAC runs the regional payment and card systems. Public contracts follow the procurement code of 6 June 2008, with a regulator that audits and settles disputes, while mining operators work to the Directorate General of Mines' procedures. ARCEP regulates electronic communications and the post. Certificates for Central African organisations usually carry accreditation from another economy within the international arrangements, and French is the working language of statutes and tenders. Sterling's Casablanca office serves clients across the country, drawing on 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement. Audits and consulting are delivered remotely, or on site where it is practical and safe to do so. Accredited certification bodies issue the certificates, never Sterling.
ISO and GRC standards Sterling delivers in Central African Republic
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Central African Republic (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi n° 24.001 portant protection des données à caractère personnel The agency in charge of the protection of personal data, which the law defines as an independent administrative authority responsible for ensuring compliance with the law across the country. The law gives the ministry in charge of the digital economy, posts and telecommunications a fixed period from promulgation to set the agency up, and provides that the supervising ministry performs the agency's missions until then | The law sets the rules for processing personal data by establishments in the country and for processing that has effects there, and leaves out purely personal or household use. Processing must be lawful, fair, transparent, secure, tied to a purpose, accurate, proportionate and limited in time, and data is destroyed or anonymised once it is no longer needed. Lawful grounds include contract, legal obligation, legitimate interests, vital interests, public-interest tasks and explicit consent, which can be withdrawn as easily as it was given; where a minor's consent is needed it comes from the holder of parental authority. Sensitive data is barred in principle, with listed exceptions, and criminal-offence data is reserved to courts and public authorities. Processors act only on the controller's instructions under a contract that sets their security and confidentiality duties. People are told who collects their data and why, and have rights to object, to access, and to correct, block or erase; direct marketing needs prior consent and an easy opt-out. Every controller designates a data protection officer, who keeps the register of processing, lives in the country and is notified in writing, and whose appointment dispenses the controller from declaration formalities except where authorisation is required. Transfers abroad need similar protection with the agency informed beforehand, and interconnection of files needs the agency's authorisation. The agency can warn, order processing to stop, fine or withdraw an authorisation, and the law also creates criminal offences. Confirm with your counsel how the agency now operates and how the law applies to you. | |
| Autorité de Régulation des Communications Électroniques et de la Poste (ARCEP), Bangui Electronic communications and the post | ARCEP publishes the legal texts of its field in the legislation section of its site, including the data protection law, and the Ministry of Finance practical guide lists a law governing electronic communications. The ARCEP site does not name ISO/IEC 27001 or any other standard. | |
| Banking Commission of Central Africa (COBAC), published on the site of the Bank of Central African States (BEAC) Banks and other credit institutions | COBAC regulations listed on the BEAC site include R-2008/01 on the obligation for credit institutions to draw up a business continuity plan, R-2016/04 on internal control and Règlement N°04/18/CEMAC/UMAC/COBAC of 21 December 2018 on payment services. The BEAC lists Centrafrique among its six member states and has a national directorate in Bangui. | |
| Bank of Central African States (BEAC) Payment systems and interbank cards | The BEAC presents the regional payment reform, the large-value system SYGMA, the clearing system SYSTAC, the interbank card system GIMACPAY administered by the Groupement Interbancaire Monétique de l'Afrique Centrale (GIMAC) and a payment incidents centre. The page does not name PCI DSS. | |
| Autorité de Régulation des Marchés Publics (ARMP), with the Direction Générale des Marchés Publics (DGMP) under the Ministry of Finance and Budget Public procurement | Loi n° 08.017 portant Code des marchés publics et délégations de service public, promulgated on 6 June 2008. The ARMP handles regulation, advice, training, external audits and disputes, and the DGMP carries out prior control. The Ministry of Finance guide to the code does not mention quality certification or ISO standards. | |
| Ministry of Mines and Geology and its Direction Générale des Mines Mining and quarrying | The Direction Générale des Mines' procedures guide for operators (November 2018) cites Loi n°09.005 du 29 avril 2009 portant Code Minier. It asks operators to protect the environment and rehabilitate exploited sites, ties semi-mechanised artisanal permits to public-health and workplace-safety norms, requires a dedicated guarantee account, detailed and transparent accounts and an export control register, and asks for rational exploitation. It does not name an ISO standard. | |
| The environment administration under the Environment Code Environment and impact assessment | The Ministry of Finance practical guide for businesses lists an Environment Code and the arrangements for approving experts authorised to carry out environmental and social impact assessments. The guide gives no clause and does not name ISO 14001. | |
| Agence Autonome de Régulation du Secteur de l'Electricité (ARSEC) Electricity | The practical guide lists an electricity code and the statutes of ARSEC under its energy heading. It does not name ISO 50001. |
Accreditation and recognition
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Code des marchés publics (Loi n° 08.017 of 6 June 2008) and the public procurement regulator (Autorité de Régulation des Marchés Publics (ARMP) and the Direction Générale des Marchés Publics (DGMP), with each contracting authority's procurement unit): The code covers the State, local authorities, public establishments, agencies and state companies, and private entities acting for them or receiving state aid; it lets tender documents grant a stated price preference to national firms and to firms based in CEMAC countries, and externally financed contracts follow the code unless the financing agreement says otherwise. Standard bidding documents are based on multilateral development bank models. The Ministry of Finance guide to the code does not mention ISO certificates, so a quality or safety certificate matters only where a tender document asks for it.
Sterling in Central African Republic
Sterling delivers in Central African Republic from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Central African Republic clients ask
Does the Central African Republic have a personal data protection law?
Yes. Loi n° 24.001 portant protection des données à caractère personnel is a promulgated text that sets rules for processing data in the country. It provides for an independent agency to supervise compliance and makes the supervising ministry perform that role until the agency is set up. Ask your counsel how the agency operates today before you plan filings.
Must a company in the Central African Republic appoint a data protection officer?
The law says every controller designates one. The officer must be qualified, live in the country, be notified in writing, keep the register of processing and advise on new processing, and the controller or its legal representative cannot hold the post. Appointing one dispenses the controller from declaration formalities, except where authorisation is required.
Are certification audits in the Central African Republic conducted in French?
Usually, yes. The BEAC lists French and Sango as official languages, and the statutes and regulator texts are published in French, so tender files and controlled documents normally follow. Settle the audit language, any interpreter and the language of documents with the certification body at application, and mention early if site teams mainly speak Sango.
Which rules apply to banks and payment firms in the Central African Republic?
They sit under the regional framework of the Bank of Central African States, whose list of COBAC regulations includes texts on business continuity plans, internal control and payment services. The BEAC also runs the large-value, clearing and interbank card systems that members connect to. None of these pages names an ISO standard or PCI DSS, so ask your bank or acquirer what evidence it wants.
Do public tenders in the Central African Republic require ISO certificates?
Not as a general rule. The procurement code of 6 June 2008 sets the procedures, the regulator ARMP audits and settles disputes, and the Ministry of Finance's guide to the code does not mention ISO certificates, so each tender document sets its own criteria. Read the bidding documents closely, and note that the code allows a stated price preference for national and CEMAC-based firms.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi n° 24.001 portant protection des données à caractère personnel — arcep.cf (accessed 18 Oct 2026)
- ARCEP publishes the legal texts of its field in the legislation section of its site, including the data protection law, and the Ministry of Finance practical guide lists a law governing electronic communications. The ARCEP site does not name ISO/IEC 27001 or any other standard. — arcep.cf (accessed 18 Oct 2026)
- COBAC regulations listed on the BEAC site include R-2008/01 on the obligation for credit institutions to draw up a business continuity plan, R-2016/04 on internal control and Règlement N°04/18/CEMAC/UMAC/COBAC of 21 December 2018 on payment services. The BEAC lists Centrafrique among its six member states and has a national directorate in Bangui. — beac.int (accessed 18 Oct 2026)
- The BEAC presents the regional payment reform, the large-value system SYGMA, the clearing system SYSTAC, the interbank card system GIMACPAY administered by the Groupement Interbancaire Monétique de l'Afrique Centrale (GIMAC) and a payment incidents centre. The page does not name PCI DSS. — beac.int (accessed 18 Oct 2026)
- Loi n° 08.017 portant Code des marchés publics et délégations de service public, promulgated on 6 June 2008. The ARMP handles regulation, advice, training, external audits and disputes, and the DGMP carries out prior control. The Ministry of Finance guide to the code does not mention quality certification or ISO standards. — finances.gouv.cf (accessed 18 Oct 2026)
- The Direction Générale des Mines' procedures guide for operators (November 2018) cites Loi n°09.005 du 29 avril 2009 portant Code Minier. It asks operators to protect the environment and rehabilitate exploited sites, ties semi-mechanised artisanal permits to public-health and workplace-safety norms, requires a dedicated guarantee account, detailed and transparent accounts and an export control register, and asks for rational exploitation. It does not name an ISO standard. — mines.gouv.cf (accessed 18 Oct 2026)
- The Ministry of Finance practical guide for businesses lists an Environment Code and the arrangements for approving experts authorised to carry out environmental and social impact assessments. The guide gives no clause and does not name ISO 14001. — finances.gouv.cf (accessed 18 Oct 2026)
- The practical guide lists an electricity code and the statutes of ARSEC under its energy heading. It does not name ISO 50001. — finances.gouv.cf (accessed 18 Oct 2026)
- Code des marchés publics (Loi n° 08.017 of 6 June 2008) and the public procurement regulator — finances.gouv.cf (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice