Where we work · Congo
ISO and GRC certification consulting in Congo
Achieve ISO and GRC certification in Congo with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in Congo
- Oil and gas operators, service companies and subcontractors
- Mining and quarrying operators and their contractors
- Timber and forest-products operators
- Banks, microfinance and payment firms in the CEMAC system
- Agri-food processors, palm-oil producers and importers of packaged food
- Construction and public-works contractors
Clients include
ISO and GRC certification in Congo at a glance
Congo's compliance picture is assembled from a short list of concrete texts. Law No. 29-2019 of 10 October 2019 sets the rules for personal data, and Law No. 26-2020 of 5 June 2020 on cybersecurity puts public bodies' information systems under a periodic security audit and asks operators to report attacks without delay. The Hydrocarbons Code of 2016, the Forestry Code of 2020 and the Mining Code published in April 2026 govern the extractive and timber sectors, while banks follow COBAC regulations circulated through the Bank of Central African States, and the Public Procurement Code lets buyers ask bidders for qualification evidence. Compulsory national standards for packaged food and palm oil, the Pointe-Noire special economic zone and a construction code with mandatory technical control add manufacturing and agri-food demand. Certificates for Congolese organisations usually carry accreditation from another economy within the international arrangements, and French is the working language of statutes and tenders. Sterling's Casablanca office serves clients across the Republic of the Congo, drawing on 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement. Accredited certification bodies issue the certificates, never Sterling.
ISO and GRC standards Sterling delivers in Congo
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Congo (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel The commission in charge of personal data protection, which the law defines as created by a separate law of the Republic; under this law it receives declarations, grants authorisations, gives opinions on state processing, receives breach notifications, authorises certain transfers abroad and can take administrative measures that are open to appeal before the Supreme Court | The law applies to collection and processing of personal data by individuals, the State, decentralised authorities and public or private legal persons, to any controller on Congolese territory, and to controllers established elsewhere that use processing means located in Congo, who must appoint a representative there. Processing needs consent unless the law lists an exception (legal duty, public-interest task, contract, vital interests). Processing is declared to the commission or, for listed categories such as genetic, health-research, criminal-offence, biometric and national-identifier data and for interconnection of files, needs its authorisation. Controllers inform people at collection, keep a register of processing, apply security measures, notify breaches to the commission without delay, carry out impact assessments for high-risk processing and designate a data protection officer in the cases the law lists. Transfers to countries outside the CEMAC/CEEAC area need an adequate level of protection and prior information of the commission. People have rights of access, correction, objection and portability, and a minor can consent alone only from the digital age the law sets. The law contains transition provisions; confirm with counsel or the commission how they apply to you. | |
| Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité The national information systems security agency that the law provides for and says is created by a separate law | The law sets the national framework for the security of information systems and electronic communications networks. Anyone who holds or operates information systems must assess risks and prevent, detect and respond to incidents; the systems of public bodies are subject to a compulsory and periodic security audit, with the criteria, periodicity and follow-up fixed by regulation; audits are carried out by experts, individuals or companies, approved beforehand by the agency; every operator of an information system or network, public or private, informs the agency without delay of attacks, intrusions and other disturbances. The Journal officiel of 27 August 2020 also publishes the law and decree on the African Union convention on cybersecurity and personal data protection. | |
| The national information systems security agency provided for by Law No. 26-2020 Information systems security of public bodies and operators of information systems and networks | Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité. The law requires risk assessments, a compulsory periodic audit of public bodies' systems by experts approved by the agency, and prompt information of the agency about attacks and intrusions. It does not name ISO/IEC 27001. | |
| The ministry in charge of hydrocarbons and its hydrocarbons administration Upstream oil and gas operators, contractors and subcontractors | Loi n° 28-2016 du 12 octobre 2016 portant code des hydrocarbures sets hygiene, health, safety, environment and local-content rules for contractors, and Décret n° 2019-342 du 15 novembre 2019 fixes the conditions for subcontracting in the upstream sector, including local participation in the capital and an approval file filed through the departmental hydrocarbons directorate. Further decrees of 15 November 2019 cover service provision, penalties for breaching local-content rules and the employment and training of Congolese staff. Neither text names an ISO standard. | |
| The administration in charge of mines and geology, with the environment, labour and public health administrations Mining and quarrying | Loi n° 1-2026 du 18 avril 2026 portant code minier en République du Congo, published in a special edition of the Journal officiel of 20 April 2026. It governs exploration, exploitation, processing and trade of mineral substances, obliges permit holders to respect workplace hygiene and safety and radiation-protection rules, to protect the environment and health of populations, to rehabilitate sites and to carry out a periodic environmental and social audit, and defines certification of mineral substances (nature, origin and traceability along the supply chain) in line with national, regional and international standards. | |
| The ministry in charge of forests Forestry and timber | Loi n° 33-2020 du 8 juillet 2020 portant code forestier. The code rests forest management on legality and traceability of timber, defines a certificate of legality and a legality verification system, requires management plans drawn up under national standards set by order, and provides for a national forest certification system based on international standards, with the conditions fixed by decree. | |
| Banking Commission of Central Africa (COBAC), published on the site of the Bank of Central African States (BEAC) Banks and other credit institutions | COBAC regulations listed on the BEAC site include R-2008/01 on the obligation for credit institutions to draw up a business continuity plan and R-2016/04 on internal control. The BEAC site lists Congo among its member states. | |
| Bank of Central African States (BEAC), whose member states include Congo Payment systems and interbank cards | The BEAC presents the reform of the payment systems and means of payment of the CEMAC, the large-value system SYGMA, the clearing system SYSTAC, the interbank card system GIMACPAY administered by the Groupement Interbancaire Monétique de l'Afrique Centrale (GIMAC) and a payment incidents centre. The page does not name PCI DSS. | |
| The ministries in charge of industry, trade, health and agriculture, which sign the orders and share their enforcement Packaged food and edible palm oil | Arrêté n° 19522 du 5 août 2015 approves the Congolese standard for labelling prepacked foods and Arrêté n° 19523 du 5 août 2015 the standard for edible palm oil; both make the standard compulsory throughout the national territory, for imported and locally made products, with a transition period for the agri-food industry. The orders do not mention HACCP or ISO 22000. | |
| The ministry in charge of town planning and construction Construction and buildings | Loi n° 6-2019 du 5 mars 2019 portant code de l'urbanisme et de la construction makes technical control compulsory for buildings with special safety risks, including establishments receiving the public, buildings with a basement or upper floor, and facilities for storing, processing, preserving and packaging agricultural, livestock and fishery products. | |
| Agence Congolaise de Normalisation et de la Qualité (ACONOQ) National standards | ISO lists ACONOQ as the national standardization body of the Republic of the Congo, with the category member body. Its role here is standards only. |
Accreditation and recognition
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Code des marchés publics (Décret n° 2009-156 du 20 mai 2009) and the public procurement regulatory authority (Autorité de régulation des marchés publics, set up by Décret n° 2009-157 du 20 mai 2009, with the contracting authorities): The code lets a contracting authority ask candidates for a qualification certificate issued under objective criteria by the official body for company qualification, without making it the sole proof of capacity; it requires bidders to disclose payments to intermediaries, sets ethics rules against fraud and conflicts of interest and lets the regulator exclude companies that breach the rules. Other quality or security certificates matter only where a tender document asks for them.
Economic zones
- Special economic zones under Loi n° 24-2017 du 9 juin 2017: activities set zone by zone
- Pointe-Noire special economic zone: oil refining, industry
Sterling in Congo
Sterling delivers in Congo from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Congo clients ask
Does Congo have a personal data protection law, and who oversees it?
Yes. Law No. 29-2019 of 10 October 2019 applies to the State, local authorities and private organisations, and it gives a commission the tasks of receiving declarations, authorising sensitive processing, taking breach notifications and approving some transfers abroad. The law says that commission is created by a separate law, so ask your counsel how it operates in practice today.
Is the security of information systems audited by law in Congo?
For public bodies, yes. Law No. 26-2020 puts their information systems under a compulsory, periodic security audit by experts the national agency has approved. It also asks every operator, public or private, to tell that agency without delay about attacks or intrusions. Ask counsel how the audit rules reach a private company.
Are certification audits in Congo conducted in French?
Usually, yes. The Constitution makes French the official language, so statutes, the Journal officiel and most tender documents are in French, while Lingala and Kituba are the national vehicular languages heard on many shop floors. Settle the audit language, any interpreter and the controlled-document language with the certification body at application.
What health, safety and environmental rules apply to oil and mining operators in Congo?
Each sector has its own code. The 2016 Hydrocarbons Code lays down hygiene, health, safety, environment and local-content rules for upstream operators, while the Mining Code published in April 2026 has chapters on workplace hygiene and safety and on environmental and health protection, with a periodic environmental and social audit. Neither text names an ISO standard, so ask each operator what it requires of contractors.
Who writes Congolese standards, and does that body certify companies?
ISO lists the Agence Congolaise de Normalisation et de la Qualité (ACONOQ) as Congo's national standardization body. Its role is standards, and a management-system certificate comes from an accredited certification body. Ministerial orders of 2015 also made national standards for prepacked-food labelling and edible palm oil compulsory, so check which national standards cover your product.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel — sgg.cg (accessed 18 Oct 2026)
- Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité — sgg.cg (accessed 18 Oct 2026)
- Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité. The law requires risk assessments, a compulsory periodic audit of public bodies' systems by experts approved by the agency, and prompt information of the agency about attacks and intrusions. It does not name ISO/IEC 27001. — sgg.cg (accessed 18 Oct 2026)
- Loi n° 28-2016 du 12 octobre 2016 portant code des hydrocarbures sets hygiene, health, safety, environment and local-content rules for contractors, and Décret n° 2019-342 du 15 novembre 2019 fixes the conditions for subcontracting in the upstream sector, including local participation in the capital and an approval file filed through the departmental hydrocarbons directorate. Further decrees of 15 November 2019 cover service provision, penalties for breaching local-content rules and the employment and training of Congolese staff. Neither text names an ISO standard. — sgg.cg (accessed 18 Oct 2026)
- Loi n° 1-2026 du 18 avril 2026 portant code minier en République du Congo, published in a special edition of the Journal officiel of 20 April 2026. It governs exploration, exploitation, processing and trade of mineral substances, obliges permit holders to respect workplace hygiene and safety and radiation-protection rules, to protect the environment and health of populations, to rehabilitate sites and to carry out a periodic environmental and social audit, and defines certification of mineral substances (nature, origin and traceability along the supply chain) in line with national, regional and international standards. — sgg.cg (accessed 18 Oct 2026)
- Loi n° 33-2020 du 8 juillet 2020 portant code forestier. The code rests forest management on legality and traceability of timber, defines a certificate of legality and a legality verification system, requires management plans drawn up under national standards set by order, and provides for a national forest certification system based on international standards, with the conditions fixed by decree. — sgg.cg (accessed 18 Oct 2026)
- COBAC regulations listed on the BEAC site include R-2008/01 on the obligation for credit institutions to draw up a business continuity plan and R-2016/04 on internal control. The BEAC site lists Congo among its member states. — beac.int (accessed 18 Oct 2026)
- The BEAC presents the reform of the payment systems and means of payment of the CEMAC, the large-value system SYGMA, the clearing system SYSTAC, the interbank card system GIMACPAY administered by the Groupement Interbancaire Monétique de l'Afrique Centrale (GIMAC) and a payment incidents centre. The page does not name PCI DSS. — beac.int (accessed 18 Oct 2026)
- Arrêté n° 19522 du 5 août 2015 approves the Congolese standard for labelling prepacked foods and Arrêté n° 19523 du 5 août 2015 the standard for edible palm oil; both make the standard compulsory throughout the national territory, for imported and locally made products, with a transition period for the agri-food industry. The orders do not mention HACCP or ISO 22000. — sgg.cg (accessed 18 Oct 2026)
- Loi n° 6-2019 du 5 mars 2019 portant code de l'urbanisme et de la construction makes technical control compulsory for buildings with special safety risks, including establishments receiving the public, buildings with a basement or upper floor, and facilities for storing, processing, preserving and packaging agricultural, livestock and fishery products. — sgg.cg (accessed 18 Oct 2026)
- ISO lists ACONOQ as the national standardization body of the Republic of the Congo, with the category member body. Its role here is standards only. — iso.org (accessed 18 Oct 2026)
- Code des marchés publics (Décret n° 2009-156 du 20 mai 2009) and the public procurement regulatory authority — sgg.cg (accessed 18 Oct 2026)
- Special economic zones under Loi n° 24-2017 du 9 juin 2017 — sgg.cg (accessed 18 Oct 2026)
- Pointe-Noire special economic zone — sgg.cg (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice