Where we work · Gabon
ISO and GRC certification consulting in Gabon
Achieve ISO and GRC certification in Gabon with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in Gabon
Clients include
ISO and GRC certification in Gabon at a glance
Data protection moved to the front of Gabon's compliance agenda when Law n°025/2023 of 12 July 2023 amended the 2011 personal data law and set up the Autorité pour la Protection des Données Personnelles et de la Vie Privée (APDPVP) as an independent authority. Companies declare processing to it, seek authorisation for sensitive or cross-border uses and keep records, while a companion cybersecurity law of the same date adds duties for system operators and critical infrastructure. Banks sit under the Commission Bancaire de l'Afrique Centrale (COBAC), telecom operators answer to ARCEP, and food and fishery businesses deal with the Agence Gabonaise de Sécurité Alimentaire (AGASA). Industrial demand comes from timber processing in the Gabon Special Economic Zone, mining, oil and gas, and the ports run by OPRAG. Certification is issued by accredited certification bodies, never by Sterling, and certificates for Gabonese organisations usually carry accreditation from another economy within the international arrangements. Sterling serves Gabon from its Casablanca office, bringing 8,100+ client engagements in 60+ countries, 20+ years of practice, and Effivity and Sterling Academy included with every engagement.
ISO and GRC standards Sterling delivers in Gabon
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Gabon (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi n°025/2023 du 12 juillet 2023 portant modification de la loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel Autorité pour la Protection des Données Personnelles et de la Vie Privée (APDPVP), an independent administrative authority created by the law | Applies to any collection, storage and use of personal data by individuals and by public or private legal entities, and to controllers outside Gabon that use processing means located in Gabon, who must appoint a representative established in Gabon. Automated processing is declared to the APDPVP, which issues a receipt; sensitive and other listed categories need its prior authorisation. The law sets principles for lawful, limited and accurate processing, demonstrable consent, data subject rights including access, rectification, erasure, restriction and portability, security and confidentiality duties for controllers and processors, a written contract with processors, a register of processing activities for organisations of ten or more employees (and smaller ones where processing is risky, regular or sensitive), designation of a data protection officer in the same risk cases with notification to the APDPVP, prompt notification of data breaches to the APDPVP, authorisation for transfers to another State, and a chapter on artificial intelligence systems that include personal data. | |
| APDPVP declaration, authorisation and transfer services Autorité pour la Protection des Données Personnelles et de la Vie Privée (APDPVP) | The APDPVP's site states that formal declarations are made at its registration office on controlled paper forms, while the downloadable forms are for practice only. Its public lists show declarations and authorisations from banks, insurers, telecom operators, mining and energy companies, airlines, retailers and health providers, including authorisations to transfer personal data abroad. The authority may issue a warning, a formal notice to stop breaches, a temporary withdrawal, or an order to interrupt, block or ban processing, as it states on its sanctions page. | |
| Loi n°027/2023 du 12 juillet 2023 portant règlementation de la cybersécurité et de la lutte contre la cybercriminalité en République Gabonaise The competent administrative authority for information system security, as the law designates it; its institutional framework lists the ministries in charge of the digital economy, justice, defence, security, the economy and the budget | Operators of information systems must take technical and administrative measures to secure their services and adopt standardised systems to identify, assess, treat and manage security risks continuously; networks and information systems are subject to a mandatory, periodic security audit on terms set by regulation. Operators of critical infrastructure list their sensitive information systems, submit protection plans for approval and have implementation certified. Outsourcing a sensitive State information system needs a reasoned opinion, and confidential or sensitive State data are hosted in Gabon unless a written derogation is given. The law also creates cybercrime offences. | |
| Commission Bancaire de l'Afrique Centrale (COBAC), within the Banque des États de l'Afrique Centrale (BEAC) system Banks, payment providers and financial institutions | COBAC was created by a convention signed on 16 October 1990 by Cameroon, Congo, Gabon, Equatorial Guinea, the Central African Republic and Chad; its stated task is to ensure that credit institutions respect the laws and rules that apply to them and to sanction breaches. BEAC's payment pages also describe the regional interbank card and mobile payment system run through GIMAC. These texts do not prescribe ISO standards. | ISO/IEC 27001, PCI DSS, ISO 22301, ISO 37301 |
| Autorité de Régulation des Communications Électroniques et des Postes (ARCEP) Telecom operators and electronic communications services | Independent administrative authority created by Ordonnance n°000008/PR/2012 of 13 February 2012, ratified by loi n°006/2012 of 13 August 2012; its stated missions include checking that operators respect their licences, authorisations, approvals and specifications, and it publishes a list of approved equipment. | ISO/IEC 20000-1, ISO/IEC 27001, ISO 22301 |
| Competent administrative authority for information system security, as Loi n°027/2023 designates it Operators of information systems and critical infrastructure | Loi n°027/2023 of 12 July 2023 on cybersecurity and the fight against cybercrime: standardised, continuous security risk management, mandatory periodic security audit, critical infrastructure protection plans with security certification, and rules on outsourcing and hosting of sensitive State data. The law does not name ISO standards. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1, ISO/IEC 27701 |
| Agence Gabonaise de Sécurité Alimentaire (AGASA) Food, agriculture and fishery businesses | AGASA's own site lists sanitary, phytosanitary and fisheries approvals (agréments), sections on import and export of animal and plant products and of fishery and aquaculture products, border inspection posts, a food analysis laboratory and a quality policy. The pages do not name HACCP or ISO 22000 as conditions of approval. | HACCP, ISO 22000, FSSC 22000, ISO/IEC 17025 |
| Minister in charge of public health (approval of private establishments); Direction Générale des Douanes et Droits Indirects for the customs regime Pharmaceutical importers, distributors and medical suppliers | The customs directorate states that duty exemption on medicines and medical devices is limited to listed entities, which include private establishments importing or distributing pharmaceutical products that hold an approval (agrément) issued by the Minister in charge of health, under the finance law and arrêté it cites. | ISO 13485 |
| Ministry in charge of mines; Société Équatoriale des Mines for the State's mining interests Mining and mineral processing | The customs directorate cites the Code Minier (Loi n° 037/2018 of 11 June 2019) and a mining convention as the basis for import relief in research and exploitation phases; Société Équatoriale des Mines describes itself as the State's key actor for managing and developing its mining interests, created by presidential decree n°1018/PR/MMPH of 24 August 2011. | ISO 45001, ISO 14001, ISO 50001 |
| Direction Générale des Douanes et Droits Indirects (customs regime); petroleum administration as the petroleum convention provides Oil, gas and energy | The customs directorate describes a petroleum regime under Loi N°14/74 of 21 January 1975, with relief on research equipment and a reduced overall duty rate in the production phase, granted on production of a petroleum convention and an import programme. | ISO 14001, ISO 45001, ISO 50001, ISO 22301 |
| Direction Générale des Douanes et Droits Indirects (customs regime); Gabon Special Economic Zone for zone tenants Timber processing and industrial production | Customs describes import relief and temporary admission for wood-processing equipment under Loi de Finances 11/2012 of 08/01/2013, conditional on a favourable opinion on the investment plan from the technical ministry. GSEZ states that sustainability, traceability and certification are among its priorities. | ISO 9001, ISO 14001, ISO 45001, ISO 50001 |
| Office des Ports et Rades du Gabon (OPRAG), the national port authority Ports, shipping and logistics | OPRAG describes itself as a national public establishment of an industrial and commercial nature operating the ports of Owendo, Libreville and Port-Gentil; its service pages cover safety, security and environment and ship-call management. | ISO 14001, ISO 45001, ISO 22301, ISO 9001 |
Accreditation and recognition
- No national accreditation body: The member list of the international accreditation arrangement (mutual recognition committee members, dated 31 December 2025; the arrangement passed to Global ACI on 1 January 2026) shows no accreditation body for Gabon, either as a signatory or as a non-signatory member.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Code des marchés publics (Décret n° 0254/PR/MEEDD of 2012 and Décret n° 00027/PR/MEPPDD of 17 January 2018) and the Agence de Régulation des Marchés Publics (ARMP) (Agence de Régulation des Marchés Publics (ARMP), an independent administrative authority in Libreville): The ARMP describes itself as the independent administrative authority that regulates public procurement and public service delegations under the successive procurement codes of 2012 and 2018. Its stated tasks are to assist the national authorities with policy and regulation, to train everyone involved in public purchasing, to carry out independent technical audits and to settle disputes arising from the award and performance of contracts outside the courts. Its site lists the codes, decrees, orders, laws and standard documents, and has a page for appeals. Qualification criteria and the evidence required are set in each bidding document, so read the qualification clause of the tender you are bidding on.
Economic zones
- Gabon Special Economic Zone (GSEZ): timber processing, industrial production, furniture
- GSEZ Nkok: timber processing, multi-sector industry
- GSEZ Ikolo: timber processing, multi-product industry
- GSEZ Mpassa Lebombi: timber processing
Sterling in Gabon
Sterling delivers in Gabon from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Gabon clients ask
Must a company declare its processing of personal data to the authority in Gabon?
Yes for automated processing: the amended data protection law has controllers declare it to the Autorité pour la Protection des Données Personnelles et de la Vie Privée, which issues a receipt, while sensitive and other listed categories need its prior authorisation. The authority takes formal filings at its registration office. Confirm the route for your processing with your counsel or the authority.
Can personal data leave Gabon?
Only with the authority's authorisation. The law lets a controller send personal data to another State on the authority's authorisation, and the authority publishes a list of States it treats as protecting privacy adequately; limited exceptions exist, such as express consent combined with a listed necessity. Its public register shows transfer authorisations granted to companies in several sectors. Check the position for your flows with the regulator.
Does the cybersecurity law oblige Gabonese operators to hold ISO 27001?
No. Loi n°027/2023 does not name ISO 27001. It requires operators to run standardised, continuous security risk management and to undergo a periodic security audit on terms set by regulation, and critical infrastructure operators must have protection plans approved. An ISO/IEC 27001 certificate is a recognised way to evidence that discipline, but the competent authority decides what it accepts.
Which accreditation do certificates for Gabonese organisations usually carry?
Usually accreditation from a body in another economy, working within the international mutual recognition arrangements (Global ACI, formerly the IAF MLA). When you choose a certification body, check that its accreditation covers your standard and sector, and that your regulator, buyer or lender accepts it. Sterling does not certify; the certification body issues the certificate.
In which language are audits in Gabon usually conducted?
Mostly French. The Official Journal, the data protection authority and the customs directorate publish in French, so registers, procedures and regulator filings are normally kept in French, while English works for multinational clients. Agree the audit language, interpreter needs and the language of controlled documents with the certification body when you apply.
Who oversees food safety approvals for Gabonese food and fishery businesses?
The Agence Gabonaise de Sécurité Alimentaire, AGASA. Its site lists sanitary, phytosanitary and fisheries approvals, import and export procedures for animal, plant and fishery products, border inspection posts and a food analysis laboratory. A HACCP or ISO 22000 system supports those approvals as evidence of control, though the pages do not make either a condition.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi n°025/2023 du 12 juillet 2023 portant modification de la loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel — apdpvp.ga; afapdp.org (accessed 18 Oct 2026)
- APDPVP declaration, authorisation and transfer services — apdpvp.ga (accessed 18 Oct 2026)
- Loi n°027/2023 du 12 juillet 2023 portant règlementation de la cybersécurité et de la lutte contre la cybercriminalité en République Gabonaise — afapdp.org (accessed 18 Oct 2026)
- COBAC was created by a convention signed on 16 October 1990 by Cameroon, Congo, Gabon, Equatorial Guinea, the Central African Republic and Chad; its stated task is to ensure that credit institutions respect the laws and rules that apply to them and to sanction breaches. BEAC's payment pages also describe the regional interbank card and mobile payment system run through GIMAC. These texts do not prescribe ISO standards — beac.int (accessed 18 Oct 2026)
- Independent administrative authority created by Ordonnance n°000008/PR/2012 of 13 February 2012, ratified by loi n°006/2012 of 13 August 2012; its stated missions include checking that operators respect their licences, authorisations, approvals and specifications, and it publishes a list of approved equipment — arcep.ga (accessed 18 Oct 2026)
- Loi n°027/2023 of 12 July 2023 on cybersecurity and the fight against cybercrime: standardised, continuous security risk management, mandatory periodic security audit, critical infrastructure protection plans with security certification, and rules on outsourcing and hosting of sensitive State data. The law does not name ISO standards — afapdp.org (accessed 18 Oct 2026)
- AGASA's own site lists sanitary, phytosanitary and fisheries approvals (agréments), sections on import and export of animal and plant products and of fishery and aquaculture products, border inspection posts, a food analysis laboratory and a quality policy. The pages do not name HACCP or ISO 22000 as conditions of approval — agasa.ga (accessed 18 Oct 2026)
- The customs directorate states that duty exemption on medicines and medical devices is limited to listed entities, which include private establishments importing or distributing pharmaceutical products that hold an approval (agrément) issued by the Minister in charge of health, under the finance law and arrêté it cites — douanes.ga (accessed 18 Oct 2026)
- The customs directorate cites the Code Minier (Loi n° 037/2018 of 11 June 2019) and a mining convention as the basis for import relief in research and exploitation phases; Société Équatoriale des Mines describes itself as the State's key actor for managing and developing its mining interests, created by presidential decree n°1018/PR/MMPH of 24 August 2011 — douanes.ga; gabonmining.com (accessed 18 Oct 2026)
- The customs directorate describes a petroleum regime under Loi N°14/74 of 21 January 1975, with relief on research equipment and a reduced overall duty rate in the production phase, granted on production of a petroleum convention and an import programme — douanes.ga (accessed 18 Oct 2026)
- Customs describes import relief and temporary admission for wood-processing equipment under Loi de Finances 11/2012 of 08/01/2013, conditional on a favourable opinion on the investment plan from the technical ministry. GSEZ states that sustainability, traceability and certification are among its priorities — douanes.ga; gsez.com (accessed 18 Oct 2026)
- OPRAG describes itself as a national public establishment of an industrial and commercial nature operating the ports of Owendo, Libreville and Port-Gentil; its service pages cover safety, security and environment and ship-call management — oprag.ga (accessed 18 Oct 2026)
- No national accreditation body — iaf.nu (accessed 23 Oct 2026)
- Code des marchés publics (Décret n° 0254/PR/MEEDD of 2012 and Décret n° 00027/PR/MEPPDD of 17 January 2018) and the Agence de Régulation des Marchés Publics (ARMP) — armp.ga (accessed 23 Oct 2026)
- Gabon Special Economic Zone (GSEZ) — gsez.com (accessed 23 Oct 2026)
- GSEZ Nkok — gsez.com (accessed 23 Oct 2026)
- GSEZ Ikolo — gsez.com (accessed 23 Oct 2026)
- GSEZ Mpassa Lebombi — gsez.com (accessed 23 Oct 2026)
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice