Where we work · Ghana
ISO and GRC certification consulting in Ghana
Achieve ISO and GRC certification in Ghana with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Lagos office team
- Effivity and Academy included
Sectors that ask for certification in Ghana
Clients include
ISO and GRC certification in Ghana at a glance
Ghana's compliance picture shifted in March 2026, when the Bank of Ghana's Cyber and Information Security Directive told regulated financial institutions to be ISO/IEC 27001 certified and card-handling institutions and their agents to be PCI-DSS certified, with a proportionality annexure that lets lower tiers seek exemption. Alongside it sit the Data Protection Act, 2012 (Act 843), enforced by the Data Protection Commission through a register of controllers, and the Cybersecurity Act, 2020 (Act 1038), under which the Cyber Security Authority licenses cybersecurity service providers and oversees critical information infrastructure. Mining and oil and gas suppliers answer to the Minerals Commission and the Petroleum Commission, food and medical product makers to the Food and Drugs Authority, and free zone exporters to the Ghana Free Zones Authority. Certificates are issued by accredited certification bodies, and because the Ghana Accreditation Service is listed by Global ACI as an Associate Member, many carry accreditation from other economies. Sterling's Lagos office serves Ghana, backed by 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Ghana
Each page covers who needs the standard in Ghana, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Ghana (13)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Data Protection Act, 2012 (Act 843) Data Protection Commission (DPC), established by section 1 of the Act as an independent statutory body; it implements and monitors compliance, investigates complaints and keeps the Data Protection Register (section 3) | Applies to a data controller established in Ghana that processes data there, to a controller outside Ghana that uses equipment or a data processor carrying on business in Ghana, and to information originating partly or wholly from Ghana; data that originates externally and merely transits is outside the Act. Principles are accountability, lawfulness of processing, specification of purpose, compatibility of further processing, quality of information, openness, data security safeguards and data subject participation. Controllers must register with the Commission, secure personal data with appropriate technical and organisational measures, bind processors by written contract, and notify both the Commission and the data subject of unauthorised access or acquisition as soon as reasonably practicable. Where data of foreign data subjects is sent to Ghana for processing, the controller or processor must comply with the data protection legislation of the data subject's jurisdiction. A controller may appoint a certified and qualified data protection supervisor to monitor compliance. | |
| Data Protection Commission registration, renewal and compliance reporting Data Protection Commission (DPC) | All data controllers and processors must register, including foreign companies processing personal data within Ghana, and registered entities are listed on a searchable register. The Commission's accreditation page says a Certificate of Registration is valid for two years and must then be renewed, and its registration page says a compliance report is part of renewal. The Commission recommends that medium and large controllers keep a full-time in-house Data Protection Supervisor and use a Data Protection accredited institution where that supervisor is inexperienced. It also accredits training institutions for Certified Data Protection Supervisor courses and offers paid due diligence searches on the compliance status of controllers. | |
| Draft Data Protection Bill, 2025 Data Protection Commission (DPC), which publishes the draft; the draft's arrangement of sections provides for a Data Protection Authority | A draft only. It proposes replacing the Commission with a Data Protection Authority and is not law; the Commission's current pages continue to apply Act 843. Read it as a signal of the direction of reform, not as an obligation. | |
| Bank of Ghana (BoG) Banks, deposit-taking and development finance institutions, non-bank financial institutions, payment service providers, virtual asset service providers and other institutions licensed by the Bank | Cyber and Information Security Directive, March 2026, issued under section 4 of the Bank of Ghana Act 2002 as amended and the sector Acts it lists. Its obligations on regulated financial institutions include being ISO/IEC 27001 certified and adopting ISO/IEC 27032, PCI-DSS certification for an institution and its agents that handle card data, due diligence on third-party providers, a Chief Information Security Officer, monthly incident reports and immediate notice of serious incidents. Its Annexure A sets a proportionality framework by tier, the Bank makes the final classification, and the framework shows lower tiers may apply for exemption from the ISO/IEC 27001 paragraph. Annexure B on managed security service providers refers to independent audits such as SOC 2 Type II and to ISO 22301 alignment. | ISO/IEC 27001, PCI DSS, ISO 22301, SOC 2 |
| Cyber Security Authority (CSA) Cybersecurity service providers, owners of critical information infrastructure and organisations in the designated critical sectors | Cybersecurity Act, 2020 (Act 1038). No one may provide a cybersecurity service without a licence from the Authority, and its licensing programme lists vulnerability assessment and penetration testing, digital forensics, managed cybersecurity services, cybersecurity governance, risk and compliance, and cybersecurity training. For critical information infrastructure the Minister designated 13 sectors by Gazette Notice No. 132 of 23 September 2021; the owner of a critical information infrastructure must report an incident within twenty-four hours of detection to the relevant sectoral or national Computer Emergency Response Team, cause an audit to be performed and submit a copy of the audit report to the Authority. | |
| Food and Drugs Authority (FDA) Food, drugs, food supplements, herbal medicines, veterinary medicines, cosmetics, medical devices, household chemicals, tobacco and blood products | Public Health Act, 2012 (Act 851), which the FDA names as its legal mandate. The FDA's service pages cover product registration, including food products and medical devices, and facility licensing for manufacturing, storage and food service establishments, and it publishes good manufacturing practice inspection reports. A management system certificate does not replace registration or licensing. | |
| Ghana Standards Authority (GSA) Manufacturers, importers, laboratories and users of weighing and measuring instruments | The GSA describes itself as the national statutory body for metrology, standardisation and conformity assessment, with testing, inspection, product certification, calibration and destination inspection of imported high-risk goods among its mandated activities. Its product certification page states that it is mandated under the Standards Authority Act, 1973 and permits conforming products to carry the Standard Mark. | |
| Environmental Protection Authority (EPA) Industry, mining, waste handling and any undertaking affecting the environment | Environmental Protection Act, 2025 (Act 1124), which establishes the Authority and provides for hazardous and electronic waste, with the Environmental Protection (Environmental Assessment) Regulations, 2025 and permitting guidelines for large-scale and for small and medium-scale undertakings listed on the EPA's laws page. | |
| Minerals Commission Mining companies, contractors and suppliers to mines | Minerals and Mining Act, 2006 (Act 703) as amended in 2015 (Act 900) and 2019 (Act 995); Minerals and Mining (Health, Safety & Technical) Regulations, 2012 (L.I. 2182); and the Minerals and Mining (Local Content and Local Participation) Regulations, 2020 (L.I. 2431), which the Commission says came into force on 22 December 2020 and which sit behind its procurement list of goods and services. | |
| Petroleum Commission Upstream oil and gas operators, contractors and service companies | Petroleum Commission Act, 2011 (Act 821); Petroleum (Exploration and Production) (Health, Safety and Environment) Regulations, 2017 (L.I. 2258); Petroleum (Local Content and Local Participation) Regulations, 2013 (L.I. 2204) as amended in 2021 (L.I. 2435). The Commission says all companies intending to operate in the upstream sector must register with it, and it publishes guidelines for local content plans and performance reports. | |
| Energy Commission Electricity, renewable energy and natural gas businesses, and manufacturers and importers of regulated appliances | The Commission states its mandate is to regulate and manage the development and use of Ghana's energy resources so that supply is affordable, reliable, efficient and secure. Its energy efficiency pages cover appliance regulations, market surveillance and public procurement reports; they do not set an energy management system requirement. | |
| Ministry of Communications, Digital Technology and Innovations (MoCDTI) Software, AI and digital service companies, and public bodies adopting AI | The Ministry reports that the President launched Ghana's National Artificial Intelligence Strategy in Accra on 24 April 2026, setting out a human-centred model of adoption. The Ministry's report does not make any certification mandatory. | |
| Office of the Special Prosecutor (OSP) Public and private organisations exposed to bribery and corruption risk | The OSP states it was established in 2018 under the Office of the Special Prosecutor Act, 2017 (Act 959) to investigate and prosecute corruption and corruption-related offences in the public and private sectors, recover proceeds and take steps to prevent corruption. |
Accreditation and recognition
- Ghana Accreditation Service (GHAS): National accreditation body — a Ministry of Trade and Industry document describes the Ghana Accreditation Service Act, 2023 (Act 1102) as establishing the Service as a state institution, with functions that include accreditation of conformity assessment bodies; the same document names ISO/IEC 17025 calibration and general testing and ISO 15189 clinical testing as its priority areas, and a Ghana Economic Transformation Project page calls it the Ghana National Accreditation Service (GhaNAS).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement and the Public Procurement Authority's supplier database (Public Procurement Authority (PPA), established by the Public Procurement Act, 2003 (Act 663)): The PPA's functions include maintaining a register of procurement entities and a database of suppliers, contractors and consultants, and it publishes open tenders, pre-qualification opportunities and expressions of interest. Qualification criteria are set in each tender document, and the PPA lists no general ISO certificate requirement among its functions.
- Upstream petroleum registration and local content (Petroleum Commission): Companies intending to operate in the upstream petroleum sector must register with the Commission, which publishes guidelines for local content plans and performance reports and runs an ePortal for tenders and procurement plans accessible to registered companies.
- Mining local content and procurement list (Minerals Commission): The Commission publishes a procurement list (6th edition) under the Minerals and Mining (Local Content and Local Participation) Regulations, 2020 (L.I. 2431), which names goods and services mines are expected to source locally.
Economic zones
- Free zones regulated by the Ghana Free Zones Authority (GFZA): agro-processing, oil and gas, textiles and apparel, ICT and business process outsourcing, metal fabrication, pharmaceuticals, light industry and assembly, seafood processing
Sterling in Ghana
Sterling delivers in Ghana from its Lagos office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Ghana, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Ghanaian clients ask
Which body accredits certification in Ghana?
Ghana's national accreditation body is the Ghana Accreditation Service, which Global ACI lists as an Associate Member rather than a signatory, and its stated priority areas are laboratory and clinical testing. A certification body working in Ghana is therefore usually accredited by a body in another economy within the international arrangements. Ask for its accreditation certificate and check that the scope covers your standard and sector.
Is Ghana's Data Protection Act in force, and who enforces it?
Yes. The Data Protection Commission says Act 843 has been in effect since 16 October 2012, and the Commission enforces it and keeps the register of controllers and processors. Registration is mandatory, the registration certificate lasts two years and renewal needs a compliance report. A draft Data Protection Bill, 2025 is published for comment but is not law. Confirm your position with counsel or the Commission.
Does the Bank of Ghana require ISO 27001 certification?
For regulated financial institutions, the March 2026 directive says they shall be ISO/IEC 27001 certified and adopt ISO/IEC 27032, and that institutions handling card data, with their agents, be PCI-DSS certified. The proportionality annexure lets lower tiers apply for exemption from the ISO paragraph, and the Bank makes the final classification, so ask the Bank which tier applies to you.
Do cybersecurity advisers and testers need a licence in Ghana?
Possibly. The Cybersecurity Act says nobody may provide a cybersecurity service without a licence from the Cyber Security Authority, and the Authority's licensing programme lists penetration testing, digital forensics, managed services, governance, risk and compliance advice and cybersecurity training. Check the Authority's current guidance for your activity, and ask any adviser you hire to show its licence.
Do Ghanaian government tenders require ISO certificates?
Not as a general rule. The Public Procurement Authority, created by Act 663, keeps supplier databases and publishes tenders, but each tender document sets its own qualification criteria. Oil, gas and mining suppliers face separate registration and local content rules through the Petroleum Commission and the Minerals Commission. Read a tender's qualification clause before spending on certification.
Are certification audits in Ghana conducted in English?
Yes, normally. English is Ghana's official language, as the Ghana Investment Promotion Authority's country profile states, and contracts, standards and certification documents are written in it. Shop-floor interviews may run in a local language, so agree any interpreter and the language of controlled documents with the certification body when you apply.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act, 2012 (Act 843) — dpc.gov.gh (accessed 11 Oct 2026)
- Data Protection Commission registration, renewal and compliance reporting — dpc.gov.gh (accessed 11 Oct 2026)
- Draft Data Protection Bill, 2025 — dpc.gov.gh (accessed 11 Oct 2026)
- Cyber and Information Security Directive, March 2026, issued under section 4 of the Bank of Ghana Act 2002 as amended and the sector Acts it lists. Its obligations on regulated financial institutions include being ISO/IEC 27001 certified and adopting ISO/IEC 27032, PCI-DSS certification for an institution and its agents that handle card data, due diligence on third-party providers, a Chief Information Security Officer, monthly incident reports and immediate notice of serious incidents. Its Annexure A sets a proportionality framework by tier, the Bank makes the final classification, and the framework shows lower tiers may apply for exemption from the ISO/IEC 27001 paragraph. Annexure B on managed security service providers refers to independent audits such as SOC 2 Type II and to ISO 22301 alignment. — bog.gov.gh (accessed 11 Oct 2026)
- Cybersecurity Act, 2020 (Act 1038). No one may provide a cybersecurity service without a licence from the Authority, and its licensing programme lists vulnerability assessment and penetration testing, digital forensics, managed cybersecurity services, cybersecurity governance, risk and compliance, and cybersecurity training. For critical information infrastructure the Minister designated 13 sectors by Gazette Notice No. 132 of 23 September 2021; the owner of a critical information infrastructure must report an incident within twenty-four hours of detection to the relevant sectoral or national Computer Emergency Response Team, cause an audit to be performed and submit a copy of the audit report to the Authority. — csa.gov.gh; dpc.gov.gh (accessed 11 Oct 2026)
- Public Health Act, 2012 (Act 851), which the FDA names as its legal mandate. The FDA's service pages cover product registration, including food products and medical devices, and facility licensing for manufacturing, storage and food service establishments, and it publishes good manufacturing practice inspection reports. A management system certificate does not replace registration or licensing. — fdaghana.gov.gh (accessed 11 Oct 2026)
- The GSA describes itself as the national statutory body for metrology, standardisation and conformity assessment, with testing, inspection, product certification, calibration and destination inspection of imported high-risk goods among its mandated activities. Its product certification page states that it is mandated under the Standards Authority Act, 1973 and permits conforming products to carry the Standard Mark. — gsa.gov.gh (accessed 11 Oct 2026)
- Environmental Protection Act, 2025 (Act 1124), which establishes the Authority and provides for hazardous and electronic waste, with the Environmental Protection (Environmental Assessment) Regulations, 2025 and permitting guidelines for large-scale and for small and medium-scale undertakings listed on the EPA's laws page. — epa.gov.gh (accessed 11 Oct 2026)
- Minerals and Mining Act, 2006 (Act 703) as amended in 2015 (Act 900) and 2019 (Act 995); Minerals and Mining (Health, Safety & Technical) Regulations, 2012 (L.I. 2182); and the Minerals and Mining (Local Content and Local Participation) Regulations, 2020 (L.I. 2431), which the Commission says came into force on 22 December 2020 and which sit behind its procurement list of goods and services. — mincom.gov.gh (accessed 11 Oct 2026)
- Petroleum Commission Act, 2011 (Act 821); Petroleum (Exploration and Production) (Health, Safety and Environment) Regulations, 2017 (L.I. 2258); Petroleum (Local Content and Local Participation) Regulations, 2013 (L.I. 2204) as amended in 2021 (L.I. 2435). The Commission says all companies intending to operate in the upstream sector must register with it, and it publishes guidelines for local content plans and performance reports. — petrocom.gov.gh (accessed 11 Oct 2026)
- The Commission states its mandate is to regulate and manage the development and use of Ghana's energy resources so that supply is affordable, reliable, efficient and secure. Its energy efficiency pages cover appliance regulations, market surveillance and public procurement reports; they do not set an energy management system requirement. — energycom.gov.gh (accessed 11 Oct 2026)
- The Ministry reports that the President launched Ghana's National Artificial Intelligence Strategy in Accra on 24 April 2026, setting out a human-centred model of adoption. The Ministry's report does not make any certification mandatory. — moc.gov.gh (accessed 11 Oct 2026)
- The OSP states it was established in 2018 under the Office of the Special Prosecutor Act, 2017 (Act 959) to investigate and prosecute corruption and corruption-related offences in the public and private sectors, recover proceeds and take steps to prevent corruption. — osp.gov.gh (accessed 11 Oct 2026)
- Ghana Accreditation Service (GHAS) — global-aci.org; mofep.gov.gh; getgrm.mofep.gov.gh (accessed 11 Oct 2026)
- Public procurement and the Public Procurement Authority's supplier database — ppa.gov.gh (accessed 11 Oct 2026)
- Upstream petroleum registration and local content — petrocom.gov.gh (accessed 11 Oct 2026)
- Mining local content and procurement list — mincom.gov.gh (accessed 11 Oct 2026)
- Free zones regulated by the Ghana Free Zones Authority (GFZA) — gfza.gov.gh (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Lagos team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Lagos office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice