Where we work · Dominican Republic
ISO and GRC certification consulting in Dominican Republic
Achieve ISO and GRC certification in Dominican Republic with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- New York office team
- Effivity and Academy included
Sectors that ask for certification in Dominican Republic
- Free-zone manufacturers of medical devices and pharmaceuticals
- Electrical and electronic products makers in free zones
- Tobacco, cigar and clothing manufacturers exporting from free zones
- Agro-industrial and food processors and exporters
- Call centres, BPO and shared-service firms serving overseas clients
- Banks, payment firms and other regulated financial entities
Clients include
ISO and GRC certification in Dominican Republic at a glance
Dominican demand for ISO and compliance work is shaped less by one grand regulator than by export buyers and a handful of specific rules. The free-zone council reported 858 companies and 200,237 direct jobs at the end of 2025, with medical and pharmaceutical products at 34% of free-zone exports, which keeps ISO 9001 and ISO 13485 on customer checklists. The Superintendencia de Bancos expects banks and their technology providers to follow a cybersecurity regulation that points to PCI DSS, while Law 172-13 sets data protection duties and names the Superintendencia as control body for credit reporting. DIGEMAPS registers foods, medicines and health products, the environment ministry issues permits under Law 64-00, and the labour ministry registers safety committees under Decree 522-06. The Organismo Dominicano de Acreditación accredits conformity assessment bodies in the national quality system. Certificates come from accredited certification bodies, never from Sterling. Sterling's New York office serves clients here on-site where the work needs it and remotely otherwise, with 20+ years, 8,100+ client engagements in 60+ countries, and Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Dominican Republic
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Dominican Republic (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Ley núm. 172-13 que tiene por objeto la protección integral de los datos personales asentados en archivos, registros públicos, bancos de datos u otros medios técnicos de tratamiento de datos destinados a dar informes, sean estos públicos o privados — Law 172-13 on the comprehensive protection of personal data Superintendencia de Bancos, which the law names as the órgano de control for archives, registries and data banks that provide credit reports and as the body that registers and sanctions the Sociedades de Información Crediticia (SIC). The law gives data subjects the habeas data action before the courts for other data banks and creates no general-purpose data protection authority. | Applies throughout the national territory to personal data held in any data bank, public or private. Excludes purely personal or domestic files, files of crime-investigation and intelligence bodies, files on deceased persons (with a notification route for relatives) and data on legal persons or on business contact details of individuals. Principles: lawful purposes, data quality, prior information (purpose, recipients, the file and its controller, rights) and free, express, informed consent in writing or an equivalent form. Controllers must keep data under security conditions that prevent alteration, loss, consultation and unauthorised use, adopt an internal manual of policies and procedures, and handle requests and claims. Data subjects have access, rectification, updating and cancellation rights and the habeas data action; sensitive data (political opinions, religious, philosophical or moral convictions, union membership, health and sexual life) needs express written consent; international transfers needing consent follow listed cases; the law has detailed credit-reporting rules and sanctions. It cites no ISO standard and creates no certificate. Penalties are in the law and are not restated here. | |
| Constitution of 13 June 2015 — privacy and habeas data (articles 44 and 70) Courts (habeas data and amparo actions); the Constitution names no data protection authority. | Constitutional base for Law 172-13; confirm with counsel how it applies to your processing. | |
| Superintendencia de Bancos and the Junta Monetaria Banks, payment participants and their technology providers | Reglamento de Seguridad Cibernética y de la Información, published by the Junta Monetaria under its Segunda Resolución (JM 181101-02) of 1 November 2018. It applies to financial intermediation entities, payment and settlement system participants and administrators, and to linked support and service entities; it covers a cybersecurity programme, a security officer, external provider management, technology continuity and recovery plans, internal audits, and international card standards. Article 44 expects entities that use international card services to meet objectives supported by PCI DSS, PCI PTS and PA-DSS, and article 45 adds P2PE, card production security and token service provider standards. | PCI DSS |
| Dirección General de Medicamentos, Alimentos y Productos Sanitarios (DIGEMAPS), Ministerio de Salud Pública Medicines, health products, foods, beverages and cosmetics | DIGEMAPS states it is responsible for regulating, controlling and overseeing medicines, health products, foods, beverages, cosmetics and hygiene products and the establishments, activities and processes behind them. Its services include sanitary registration of medicines, health products, cosmetics and pre-packaged foods and beverages. Its history page lists the General Health Law 42-01, Decree 528-01 on risks in foods and beverages, Decree 246-06 on medicines and Decree 231-23, which gave it functional autonomy. | |
| Ministerio de Medio Ambiente y Recursos Naturales Industry and any activity with environmental impact | Ley 64-00, Ley General sobre Medio Ambiente y Recursos Naturales. Projects and activities that may affect the environment need an environmental permit or licence before they start; the list that needs an impact assessment includes industrial plants, agro-industries, mining, hotel and tourism developments and industrial parks, maquiladoras and free zones. The permit or licence carries a management and adaptation programme with self-monitoring, and one article says companies that implement an environmental management system within the principles of the ISO 14000 standards benefit according to a regulation issued for that purpose. | ISO 14001 |
| Ministerio de Trabajo, Dirección General de Higiene y Seguridad Industrial Occupational safety and health (all employers) | Reglamento de Seguridad y Salud en el Trabajo (Decreto 522-06 of 17 October 2006): the employer sets a written safety and health policy, informs and trains workers, keeps training records and supports the workplace safety committee. Employers register a joint committee (15 or more workers) or a coordinator (fewer than 15 workers) with the Ministry. | |
| Supervisory bodies named in Ley núm. 155-17 (Superintendencia de Bancos for financial entities) Financial and other obliged entities — anti-money-laundering compliance | Ley núm. 155-17 requires obliged subjects to adopt a risk-based compliance programme with risk policies and procedures, standards for hiring and training, a disciplinary regime, a code of ethics and an external audit of effectiveness. It names no ISO standard. | |
| Comisión Nacional de Energía (CNE) Energy users and renewable-energy investors | Ley 57-07 on renewable energy incentives: the CNE handles tax-incentive requests for renewable equipment and recommends incentives, and the net metering programme operated through the distribution companies lets customers with renewable self-generation sell surplus energy. The CNE also certifies the inverters, photovoltaic modules and wind turbines installed under the programme. | |
| Instituto Dominicano para la Calidad (INDOCAL), within the Sistema Dominicano para la Calidad (SIDOCAL) Standardisation, metrology and the quality system (all sectors) | Ley 166-12 of 12 July 2012 creates SIDOCAL, with INDOCAL for standardisation and metrology and ODAC for accreditation. INDOCAL describes a technical standard as a document it approves, whose application is voluntary but can become mandatory through technical regulations, authorities' requirements or consumer and buyer preference. | |
| Criminal courts; the Presidency promulgated the new Penal Code (Ley 74-25) Corporate criminal liability | The Presidency stated on promulgation that the new Penal Code makes legal persons criminally liable for offences arising from negligence or from acts of their representatives. Confirm the date from which each provision applies and what it asks of company controls with your counsel. | |
| ProDominicana, Centro de Exportación e Inversión de la República Dominicana Export and investment promotion | ProDominicana lists investment services and export services on its official site; export buyers, not ProDominicana, set certificate requirements. |
Accreditation and recognition
- Organismo Dominicano de Acreditación (ODAC): National accreditation body — ODAC states it was created by Law 166-12 (article 72) to assess the technical competence of conformity assessment bodies and accredit them against international standards, and that it is the governmental body with legal competence in accreditation, a decentralised public-law entity attached to the Ministerio de Industria, Comercio y Mipymes. Its accreditation schemes cover testing and calibration laboratories (ISO/IEC 17025), clinical laboratories (ISO 15189), inspection bodies (ISO/IEC 17020), management system certification bodies (ISO/IEC 17021-1 and 17021-2), person certification bodies (ISO/IEC 17024) and validation and verification bodies (ISO 14065).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement and the Registro de Proveedores del Estado (RPE) (Dirección General de Contrataciones Públicas (DGCP), under Ley núm. 47-25, Ley de Contrataciones Públicas): The law qualifies bidders on professional, technical and ethical competence, financial resources, reliability, experience and personnel, and states a sustainability principle for procedures. It does not name ISO standards or require certificates as a blanket condition; each tender sets its own conditions. The DGCP's published registration requirements for national individuals centre on tax registration, up-to-date tax and social security payments and a bank certification.
- Public-sector cyber maturity controls (Presidential decrees 685-22 and 313-22, as printed in Decreto 612-24): Decreto 685-22 of 18 November 2022 sets principles and guidelines for public bodies to adopt controls, policies and standards that raise cyber maturity, with mandatory notification of cybersecurity events and incidents and exchange of threat information. It does not name ISO standards in the text where it is described, so suppliers should read each contract's security clauses.
Economic zones
- Free-zone regime under Ley 8-90 (Fomento de Zonas Francas): medical and pharmaceutical products, tobacco and its derivatives, call centres and BPO, clothing and textiles, electrical and electronic products, agro-industrial products, services
- Services free zones (zonas francas de servicios): services, call centres and BPO
- Companies under Ley 56-07:
Sterling in Dominican Republic
Sterling delivers in Dominican Republic from its New York office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Dominican Republic clients ask
Who regulates personal data in the Dominican Republic?
The statute is Law 172-13. Its control body is the Superintendencia de Bancos, but only for credit-reporting data banks and credit information companies; for other data banks people use the habeas data action in court. No general authority exists under it, so ask counsel which body or court could act on your processing.
Which body accredits certification bodies in the Dominican Republic?
The Organismo Dominicano de Acreditación (ODAC), created by Law 166-12, is the national accreditation body. It states that it is a full member of IAAC and ILAC and a signatory for inspection bodies and laboratories. A news item dated 21 September 2026 reports recognition for management system certification bodies under ISO/IEC 17021-1, so ask any body for its accreditation scope.
Are certification audits in the Dominican Republic conducted in English?
English audits are common at exporters, call centres and hotels, yet Spanish remains the official language of the Constitution, the statutes and public tenders. Settle the working language, interpreter needs and the language of controlled records when you apply, and flag early if operator interviews will take place in Spanish.
Do Dominican public tenders require ISO certificates?
No general rule says so. Law 47-25 judges bidders on competence, resources, reliability, experience and integrity without naming any ISO standard, and the supplier registry lists tax, social security and bank papers for national individuals. A given tender can still set its own technical conditions, so read them before bidding.
Which Dominican authority registers foods, medicines and medical products?
DIGEMAPS, the directorate within the Ministry of Public Health, regulates and controls medicines, health products, foods, beverages and cosmetics. Its services include sanitary registration of medicines, health products, cosmetics and pre-packaged foods and beverages. It does not make an ISO certificate a stated condition of registration, so check its procedures for your product.
How large is the free-zone sector that drives many certification requests?
At the end of 2025 the free-zone council reported 98 parks, 858 companies and 200,237 direct jobs, with exports to 148 countries. Medical and pharmaceutical products made up 34% of free-zone exports that year and electrical and electronic products 13.7%. Export buyers, rather than the free-zone law, normally set which certificates they expect.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Ley núm. 172-13 que tiene por objeto la protección integral de los datos personales asentados en archivos, registros públicos, bancos de datos u otros medios técnicos de tratamiento de datos destinados a dar informes, sean estos públicos o privados — Law 172-13 on the comprehensive protection of personal data — sb.gob.do; presidencia.gob.do (accessed 18 Oct 2026)
- Constitution of 13 June 2015 — privacy and habeas data (articles 44 and 70) — mt.gob.do (accessed 18 Oct 2026)
- Reglamento de Seguridad Cibernética y de la Información, published by the Junta Monetaria under its Segunda Resolución (JM 181101-02) of 1 November 2018. It applies to financial intermediation entities, payment and settlement system participants and administrators, and to linked support and service entities; it covers a cybersecurity programme, a security officer, external provider management, technology continuity and recovery plans, internal audits, and international card standards. Article 44 expects entities that use international card services to meet objectives supported by PCI DSS, PCI PTS and PA-DSS, and article 45 adds P2PE, card production security and token service provider standards. — sb.gob.do (accessed 18 Oct 2026)
- DIGEMAPS states it is responsible for regulating, controlling and overseeing medicines, health products, foods, beverages, cosmetics and hygiene products and the establishments, activities and processes behind them. Its services include sanitary registration of medicines, health products, cosmetics and pre-packaged foods and beverages. Its history page lists the General Health Law 42-01, Decree 528-01 on risks in foods and beverages, Decree 246-06 on medicines and Decree 231-23, which gave it functional autonomy. — digemaps.gob.do (accessed 18 Oct 2026)
- Ley 64-00, Ley General sobre Medio Ambiente y Recursos Naturales. Projects and activities that may affect the environment need an environmental permit or licence before they start; the list that needs an impact assessment includes industrial plants, agro-industries, mining, hotel and tourism developments and industrial parks, maquiladoras and free zones. The permit or licence carries a management and adaptation programme with self-monitoring, and one article says companies that implement an environmental management system within the principles of the ISO 14000 standards benefit according to a regulation issued for that purpose. — ambiente.gob.do (accessed 18 Oct 2026)
- Reglamento de Seguridad y Salud en el Trabajo (Decreto 522-06 of 17 October 2006): the employer sets a written safety and health policy, informs and trains workers, keeps training records and supports the workplace safety committee. Employers register a joint committee (15 or more workers) or a coordinator (fewer than 15 workers) with the Ministry. — mt.gob.do (accessed 18 Oct 2026)
- Ley núm. 155-17 requires obliged subjects to adopt a risk-based compliance programme with risk policies and procedures, standards for hiring and training, a disciplinary regime, a code of ethics and an external audit of effectiveness. It names no ISO standard. — sb.gob.do (accessed 18 Oct 2026)
- Ley 57-07 on renewable energy incentives: the CNE handles tax-incentive requests for renewable equipment and recommends incentives, and the net metering programme operated through the distribution companies lets customers with renewable self-generation sell surplus energy. The CNE also certifies the inverters, photovoltaic modules and wind turbines installed under the programme. — cne.gob.do (accessed 18 Oct 2026)
- Ley 166-12 of 12 July 2012 creates SIDOCAL, with INDOCAL for standardisation and metrology and ODAC for accreditation. INDOCAL describes a technical standard as a document it approves, whose application is voluntary but can become mandatory through technical regulations, authorities' requirements or consumer and buyer preference. — odac.gob.do; indocal.gob.do (accessed 18 Oct 2026)
- The Presidency stated on promulgation that the new Penal Code makes legal persons criminally liable for offences arising from negligence or from acts of their representatives. Confirm the date from which each provision applies and what it asks of company controls with your counsel. — presidencia.gob.do (accessed 18 Oct 2026)
- ProDominicana lists investment services and export services on its official site; export buyers, not ProDominicana, set certificate requirements. — prodominicana.gob.do (accessed 18 Oct 2026)
- Organismo Dominicano de Acreditación (ODAC) — odac.gob.do (accessed 18 Oct 2026)
- Public procurement and the Registro de Proveedores del Estado (RPE) — dgcp.gob.do (accessed 18 Oct 2026)
- Public-sector cyber maturity controls — cncs.gob.do (accessed 18 Oct 2026)
- Free-zone regime under Ley 8-90 (Fomento de Zonas Francas) — cnzfe.gob.do
- Services free zones (zonas francas de servicios) — cnzfe.gob.do
- Companies under Ley 56-07 — cnzfe.gob.do
Talk to a consultant
Plan your certification with the New York team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice