Where we work · Chad
ISO and GRC certification consulting in Chad
Achieve ISO and GRC certification in Chad with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in Chad
Clients include
ISO and GRC certification in Chad at a glance
Chad's compliance landscape is shaped by a compact set of texts and a few regional institutions. ARCEP lists the 2015 laws on personal data, electronic transactions, cybersecurity and the national IT security agency, and it regulates electronic communications and postal services; ADETIC runs State digital infrastructure and coordinates government information systems. Banks follow COBAC regulations circulated by the Bank of Central African States, including internal control and business continuity rules, and the Ministry of Commerce and Industry runs a Brigade Économique that checks product quality while promoting special economic zones. ANIE steers investors and exporters towards oil and energy, mining, agro-processing, and the cotton, sesame, gum arabic, livestock and groundnut chains. French and Arabic are the official languages, and certificates for Chadian organisations usually carry accreditation from another economy within the international arrangements. Sterling's Casablanca office serves clients across Chad, drawing on 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included. Accredited certification bodies issue certificates, never Sterling.
ISO and GRC standards Sterling delivers in Chad
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Chad (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi n° 007/PR/2015 portant Protection des Données à Caractère Personnel The authority the law designates; confirm its name and filing practice with counsel before relying on any registration step | ARCEP publishes the law in the same list as the 2015 laws on the national IT security and electronic certification agency, electronic transactions, and cybersecurity and cybercrime. Whether a declaration, authorisation, officer appointment or transfer rule applies to your processing depends on the Journal officiel text, so ask counsel to map the duties to your data before you plan controls. | |
| Loi n° 009/PR/2015 portant sur la Cybersécurité et la Lutte Contre la Cybercriminalité The institutions the law designates; the same list names a national agency for IT security and electronic certification created by Law No. 006/PR/2015 | The law is part of the 2015 digital package. Ask counsel which security, reporting or audit duties reach a private organisation, and treat ISO/IEC 27001 as voluntary evidence of a working security system. | |
| Loi n° 006/PR/2015 portant création de l'Agence Nationale de Sécurité Informatique et de Certification Électronique Agence Nationale de Sécurité Informatique et de Certification Électronique (the agency the law creates) | The agency's electronic certification remit concerns digital trust, not ISO management-system certificates, which come from accredited certification bodies. | |
| Loi n° 008/PR/2015 portant sur les Transactions Électroniques The institutions the law designates | Online selling, digital contracts and electronic signatures sit under this law, which matters for e-commerce, fintech and software firms that rely on electronic evidence. | |
| Autorité de Régulation des Communications Électroniques et des Postes (ARCEP) Electronic communications and postal services | Loi n° 013/PR/2014 portant régulation des communications électroniques et des activités postales; ARCEP is a public administrative body under the ministry in charge of posts and digital technologies, with exclusive power to regulate and monitor operators, to see that the laws and their implementing texts are applied, and to fix the technical norms that networks, equipment and service offers must meet. Its pages do not name an ISO standard. | |
| Agence de Développement des Technologies de l'Information et de la Communication (ADETIC) Government information systems and digital infrastructure | Loi n° 012/PR/2014 creating ADETIC. The agency says it builds and maintains secure digital infrastructure for the State, coordinates public information systems for interoperability, security and sound data management, and trains public staff in digital skills. The page does not name an ISO standard. | |
| Banking Commission of Central Africa (COBAC), published on the site of the Bank of Central African States (BEAC) Banks and other credit institutions | COBAC regulations listed on the BEAC site include R-2016/04 on internal control, R-2008/01 obliging credit institutions to draw up a business continuity plan, and Règlement n° 01/03-CEMAC-UMAC of 4 April 2003 on money-laundering prevention. The BEAC lists Chad among its member countries. | |
| Bank of Central African States (BEAC) Payment services and interbank cards | The COBAC page lists Regulation No. 04-18 of 21 December 2018 on payment services in the CEMAC, and the BEAC presents SYGMA for large-value payments, SYSTAC for clearing, the interbank card system run by GIMAC and a payment incidents centre. The pages do not name PCI DSS. | |
| Ministry of Commerce and Industry Trade, industry and product quality control | The ministry's mission page lists market regulation, price monitoring, a Brigade Économique that checks the quality of products and fair dealing in transactions, management and promotion of special economic zones, the Made in Chad label, and industrial development of cotton, livestock (meat and milk) and mining chains. The page does not name an ISO standard. | |
| Agence Nationale des Investissements et des Exportations (ANIE) Investment and exports | ANIE is a public agency with administrative and financial autonomy that promotes investment and exports and hosts the single window for company creation. Its exporter path includes bringing product and packaging up to standard; flagship exports are cotton fibre, sesame, gum arabic, livestock and hides, groundnut and spirulina. No ISO standard is named. | |
| Ministry in charge of telecommunications, the digital economy and the digitalisation of the administration Digital economy policy | The ministry's mission page lists the national digital and postal strategic plan for 2020 to 2030, regulation of electronic communications and postal activities, and the fight against cybercrime in cooperation with other institutions; its presentation page records a directorate-general for artificial intelligence created in the 2025 reorganisation. No ISO standard is named. |
Accreditation and recognition
- No national accreditation body: The member list of the international accreditation arrangement (mutual recognition committee members, dated 31 December 2025; the arrangement passed to Global ACI on 1 January 2026) shows no accreditation body for Chad, either as a signatory or as a non-signatory member.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Code des marchés publics (Décret n° 2130/PR/2020 of 15 October 2020) and the Direction Générale du Contrôle des Marchés Publics (DGCMP) (Direction Générale du Contrôle des Marchés Publics (DGCMP)): The DGCMP's information platform states that the 2020 code is the current procurement code, that the DGCMP checks in advance the regularity of the preparation and award of public contracts and gives its opinion at the key stages, and that it follows how contracts and public service delegations are carried out. The code does not cover ordinary fuel for administrative vehicles or special contracts that require defence or security secrecy. The platform publishes standard tender dossiers for works, supplies and services and intellectual services, a bidder's guide, general administrative clauses, approved contracts, procurement plans and the CEMAC regulation of June 2009 on public procurement. Qualification criteria and the evidence required are set in each bidding document, so read the qualification clause of the tender you are bidding on.
Economic zones
- Special economic zones promoted by the Ministry of Commerce and Industry: activities set zone by zone
Sterling in Chad
Sterling delivers in Chad from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Chad clients ask
Does Chad have a personal data protection law?
Yes. Law No. 007/PR/2015 on the protection of personal data appears on the ARCEP list of laws, beside the 2015 laws on cybersecurity, electronic transactions and the national IT security agency. The duties, filings and any authority are set by the Journal officiel text, so have your counsel read it against your own customer and staff data.
Who regulates telecoms and postal services in Chad?
ARCEP, the Autorité de Régulation des Communications Électroniques et des Postes. It is a public administrative body under the ministry in charge of posts and digital technologies, with exclusive competence to regulate and monitor operators and to fix the technical norms for networks, equipment and service offers. Its pages do not name an ISO standard.
Which language are certification audits held in for Chadian organisations?
French and Arabic are the official languages, so audits are usually run in one of them or in both, with an interpreter where needed. Settle the audit language, the language of the controlled documents and any translation of the standard with the certification body when you apply, and keep records in the language your site teams actually use.
Which central-bank texts matter to ISO 27001 and ISO 22301 projects at Chadian banks?
Banks answer to COBAC regulations circulated through the BEAC, among them R-2016/04 on internal control and R-2008/01, which obliges a credit institution to draw up a business continuity plan. Neither text asks for a certificate, but an ISO 27001 or ISO 22301 system gives evidence that those duties work in practice.
Can an ISO audit in Chad be carried out remotely?
Largely, yes. Document review, interviews and records sampling travel well over video, whereas plants, ranches, depots and data rooms are looked at in person when the certification body judges it necessary. Agree connectivity, access permissions and timing with the site before dates are fixed, so that nothing important is left to the last day.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi n° 007/PR/2015 portant Protection des Données à Caractère Personnel — arcep.td (accessed 18 Oct 2026)
- Loi n° 009/PR/2015 portant sur la Cybersécurité et la Lutte Contre la Cybercriminalité — arcep.td (accessed 18 Oct 2026)
- Loi n° 006/PR/2015 portant création de l'Agence Nationale de Sécurité Informatique et de Certification Électronique — arcep.td (accessed 18 Oct 2026)
- Loi n° 008/PR/2015 portant sur les Transactions Électroniques — arcep.td (accessed 18 Oct 2026)
- Loi n° 013/PR/2014 portant régulation des communications électroniques et des activités postales; ARCEP is a public administrative body under the ministry in charge of posts and digital technologies, with exclusive power to regulate and monitor operators, to see that the laws and their implementing texts are applied, and to fix the technical norms that networks, equipment and service offers must meet. Its pages do not name an ISO standard. — arcep.td (accessed 18 Oct 2026)
- Loi n° 012/PR/2014 creating ADETIC. The agency says it builds and maintains secure digital infrastructure for the State, coordinates public information systems for interoperability, security and sound data management, and trains public staff in digital skills. The page does not name an ISO standard. — adetic.td (accessed 18 Oct 2026)
- COBAC regulations listed on the BEAC site include R-2016/04 on internal control, R-2008/01 obliging credit institutions to draw up a business continuity plan, and Règlement n° 01/03-CEMAC-UMAC of 4 April 2003 on money-laundering prevention. The BEAC lists Chad among its member countries. — beac.int (accessed 18 Oct 2026)
- The COBAC page lists Regulation No. 04-18 of 21 December 2018 on payment services in the CEMAC, and the BEAC presents SYGMA for large-value payments, SYSTAC for clearing, the interbank card system run by GIMAC and a payment incidents centre. The pages do not name PCI DSS. — beac.int (accessed 18 Oct 2026)
- The ministry's mission page lists market regulation, price monitoring, a Brigade Économique that checks the quality of products and fair dealing in transactions, management and promotion of special economic zones, the Made in Chad label, and industrial development of cotton, livestock (meat and milk) and mining chains. The page does not name an ISO standard. — commerce.gouv.td (accessed 18 Oct 2026)
- ANIE is a public agency with administrative and financial autonomy that promotes investment and exports and hosts the single window for company creation. Its exporter path includes bringing product and packaging up to standard; flagship exports are cotton fibre, sesame, gum arabic, livestock and hides, groundnut and spirulina. No ISO standard is named. — anie.td (accessed 18 Oct 2026)
- The ministry's mission page lists the national digital and postal strategic plan for 2020 to 2030, regulation of electronic communications and postal activities, and the fight against cybercrime in cooperation with other institutions; its presentation page records a directorate-general for artificial intelligence created in the 2025 reorganisation. No ISO standard is named. — mpntic.gouv.td (accessed 18 Oct 2026)
- No national accreditation body — iaf.nu (accessed 23 Oct 2026)
- Code des marchés publics (Décret n° 2130/PR/2020 of 15 October 2020) and the Direction Générale du Contrôle des Marchés Publics (DGCMP) — dgcmp.org (accessed 23 Oct 2026)
- Special economic zones promoted by the Ministry of Commerce and Industry — commerce.gouv.td; anie.td (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice