Where we work · Eswatini
ISO and GRC certification consulting in Eswatini
Achieve ISO and GRC certification in Eswatini with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Johannesburg office team
- Effivity and Academy included
Sectors that ask for certification in Eswatini
Clients include
ISO and GRC certification in Eswatini at a glance
One Commission carries more of Eswatini's compliance agenda than any other body. ESCCOM, the Eswatini Communications Commission, is the data protection authority under the Data Protection Act, 2022, enforces cybersecurity under the Computer Crime and Cybercrime Act, 2022 and issues continuity planning guidelines to licensed communications providers. Its 2024 registration decision makes registering with the authority a condition of processing personal data. Beyond ESCCOM, demand follows sector regulators: the Central Bank of Eswatini for banks, the Financial Services Regulatory Authority for insurers and pension funds, and the Eswatini Environment Authority for project assessment. Exporters of beverages, sugar and textiles, which the IMF named as main exports in 2025, answer to buyers who ask for quality, food safety and environmental evidence. Eswatini has no national accreditation body, so SADCAS serves the country and certificates carry its accreditation or another body's within the international arrangements. Certification itself is by accredited certification bodies. Sterling's Johannesburg office serves Eswatini clients on-site where the work needs it and remotely otherwise, drawing on 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in Eswatini
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Eswatini (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Data Protection Act, 2022 (Act No. 5 of 2022) Eswatini Communications Commission (ESCCOM), which the Act calls 'the Commission' and which ESCCOM's own decision designates as the Eswatini Data Protection Authority (EDPA) | Covers the collection, processing, disclosure and protection of personal information. A controller notifies the Commission of its processing and may process only after notification; must keep information secure, bind processors by written contract, notify the Commission and the person affected of a security compromise as soon as reasonably possible, and give people access to and correction of their information. Transfers to other SADC states and to other countries are allowed only on the conditions the Act sets. Controllers may designate data protection officers, and the Commission can warn, serve notices, limit authorisations and impose fines. | |
| EDPA Final Decision on Registration of Data Controllers and Data Processors, 2024 Eswatini Data Protection Authority (the Eswatini Communications Commission) | Makes registration mandatory for entities that process personal data above the thresholds it sets, and for the sectors it lists, which include financial services, insurance, telecommunications, education, health, hospitality, government ministries, state-owned enterprises, NGOs and employers. It covers controllers outside Eswatini that process the personal data of people located in Eswatini. A registration certificate is issued for a set term and is renewable, and changes to registered particulars must be notified to the authority. | |
| Eswatini Communications Commission (ESCCOM) Electronic communications, cybersecurity and critical information infrastructure | Computer Crime and Cybercrime Act, 2022 (Act No. 6 of 2022), which gives the Commission the powers to regulate and coordinate cybersecurity matters and enforce standards applicable to the security of critical information infrastructures; Business Continuity and Disaster Recovery Planning Guidelines for the ICT (Electronic Communications) Industry, No. 07/2022; Electronic Communications and Transactions Act, 2022 (Act No. 3 of 2022); Eswatini National Cybersecurity Strategy 2022-2027. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 |
| Financial Services Regulatory Authority (FSRA) Insurers, pension and retirement funds, capital markets and credit and savings institutions | FSRA Act, 2010 and the rules and directives FSRA publishes, including the Insurance Directives, 2008 and Retirement Funds Directives, 2008; FSRA's mandate includes licensing providers, supervising their conduct of business and issuing guidelines. | ISO 37301, ISO/IEC 27001, ISO 22301 |
| Central Bank of Eswatini Banks | Financial Institutions Act of 2005 and the other laws the Bank lists on its legislation page; the Bank states that it regulates and supervises the banking sector and has a National Payment Systems department. | ISO/IEC 27001, PCI DSS, ISO 37301 |
| Eswatini Environment Authority Environment and development projects | Environment Management Act, 2002; every development project must go through the environmental assessment process before implementation, and the Authority administers that process. | ISO 14001 |
| Ministry responsible for labour matters, through the Chief Inspector and inspectors appointed under the Act Workplace safety and health | Occupational Safety and Health Act, 2001 (Act 9 of 2001), covering employer duties, safety and health representatives and committees and a written safety and health policy statement. | ISO 45001 |
| Ministry of Health, which hosts Eswatini's Codex Contact Point, with the National Codex Committee Food safety and Codex engagement | Eswatini has long been a member of the Codex Alimentarius Commission; the National Codex Committee brings together state and non-state actors responsible for food safety along the food chain and has recorded increased adoption of Codex texts as national standards. | HACCP, ISO 22000, FSSC 22000 |
| Eswatini Energy Regulatory Authority (ESERA) Electricity, petroleum and gas | Energy Regulatory Act, 2007; ESERA licenses electricity undertakings, approves tariffs, sets quality of supply standards and licenses and inspects petroleum and gas. | ISO 50001 |
| Anti-Corruption Commission Anti-corruption | Prevention of Corruption Act, 2006 (Act 3 of 2006), which establishes the Commission, creates offences for corrupt dealings in contracts and tenders and corrupt transactions by or with public or private bodies, and provides a register for tender defaulters. | ISO 37001 |
| Eswatini Standards Authority Standards development | Public enterprise established through the Standards and Quality Act (No. 10 of 2003); its functions include preparing and amending standards and assisting government in framing technical regulations; standards role only. | ISO 9001 |
Accreditation and recognition
- SADCAS (Southern African Development Community Accreditation Services): Multi-economy accreditation body based in Gaborone that serves Eswatini; SADCAS states that Eswatini is among the SADC countries without a national accreditation body and is serviced by SADCAS.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement regulated by ESPPRA (Eswatini Public Procurement Regulatory Agency (ESPPRA)): ESPPRA states it was established following the coming into force of the Public Procurement Act No. 7 of 2011 as the independent public procurement regulator, with responsibility for policy, regulation, oversight and capacity building. Tender notices, a supplier directory and a list of suspended suppliers appear on its site; each procuring entity sets its own eligibility and technical requirements in its tender documents.
Sterling in Eswatini
Sterling delivers in Eswatini from its Johannesburg office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Eswatini clients ask
Does an organisation in Eswatini have to register before it processes personal data?
Yes, where it falls within the registration decision. The Data Protection Act requires a controller to notify the Commission and process only after notification, and ESCCOM's 2024 decision makes registration mandatory above set thresholds and for listed sectors, including firms outside Eswatini that handle data about people located there. Check your own position with ESCCOM or counsel.
Is there a national accreditation body in Eswatini?
No. SADCAS states that Eswatini is serviced by SADCAS, the multi-economy accreditation body based in Gaborone, because the country has no national accreditation body of its own. A certificate should therefore carry SADCAS accreditation or that of another body within the international recognition arrangements, and the certification body can show its scope on request.
Who regulates cybersecurity in Eswatini?
ESCCOM does. Section 52 of the Computer Crime and Cybercrime Act, 2022 gives the Commission powers to regulate and coordinate cybersecurity matters and to enforce standards applicable to the security of critical information infrastructures. The same Commission also issues continuity planning guidelines to licensed electronic communications providers and acts as the data protection authority.
Can personal data leave Eswatini?
Yes, but only on the Act's conditions. Transfers to other SADC states and to countries outside SADC are each governed by their own provisions of the Data Protection Act, which look at necessity and, for non-SADC recipients, an adequate level of protection or a listed exception. Controllers should state planned cross-border flows when they notify the Commission.
Are audits in Eswatini carried out in English?
Normally, yes. English and siSwati are the official languages, and Acts, gazettes and regulator decisions are published in English, so management system documents are usually kept in English. Interviews on a factory floor, farm or community site may be in siSwati, so agree the language and any interpreter with the certification body when you apply.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act, 2022 (Act No. 5 of 2022) — esccom.org.sz; edpa.org.sz (accessed 18 Oct 2026)
- EDPA Final Decision on Registration of Data Controllers and Data Processors, 2024 — esccom.org.sz (accessed 18 Oct 2026)
- Computer Crime and Cybercrime Act, 2022 (Act No. 6 of 2022), which gives the Commission the powers to regulate and coordinate cybersecurity matters and enforce standards applicable to the security of critical information infrastructures; Business Continuity and Disaster Recovery Planning Guidelines for the ICT (Electronic Communications) Industry, No. 07/2022; Electronic Communications and Transactions Act, 2022 (Act No. 3 of 2022); Eswatini National Cybersecurity Strategy 2022-2027 — esccom.org.sz (accessed 18 Oct 2026)
- FSRA Act, 2010 and the rules and directives FSRA publishes, including the Insurance Directives, 2008 and Retirement Funds Directives, 2008; FSRA's mandate includes licensing providers, supervising their conduct of business and issuing guidelines — fsra.co.sz (accessed 18 Oct 2026)
- Financial Institutions Act of 2005 and the other laws the Bank lists on its legislation page; the Bank states that it regulates and supervises the banking sector and has a National Payment Systems department — centralbank.org.sz (accessed 18 Oct 2026)
- Environment Management Act, 2002; every development project must go through the environmental assessment process before implementation, and the Authority administers that process — eea.org.sz (accessed 18 Oct 2026)
- Occupational Safety and Health Act, 2001 (Act 9 of 2001), covering employer duties, safety and health representatives and committees and a written safety and health policy statement — eswatinilii.org (accessed 18 Oct 2026)
- Eswatini has long been a member of the Codex Alimentarius Commission; the National Codex Committee brings together state and non-state actors responsible for food safety along the food chain and has recorded increased adoption of Codex texts as national standards — fao.org (accessed 18 Oct 2026)
- Energy Regulatory Act, 2007; ESERA licenses electricity undertakings, approves tariffs, sets quality of supply standards and licenses and inspects petroleum and gas — esera.org.sz (accessed 18 Oct 2026)
- Prevention of Corruption Act, 2006 (Act 3 of 2006), which establishes the Commission, creates offences for corrupt dealings in contracts and tenders and corrupt transactions by or with public or private bodies, and provides a register for tender defaulters — eswatinilii.org (accessed 18 Oct 2026)
- Public enterprise established through the Standards and Quality Act (No. 10 of 2003); its functions include preparing and amending standards and assisting government in framing technical regulations; standards role only — sadcas.org; extranet.who.int (accessed 18 Oct 2026)
- SADCAS (Southern African Development Community Accreditation Services) — sadcas.org (accessed 18 Oct 2026)
- Public procurement regulated by ESPPRA — esppra.co.sz (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice