Where we work · Guinea
ISO and GRC certification consulting in Guinea
Achieve ISO and GRC certification in Guinea with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in Guinea
Clients include
ISO and GRC certification in Guinea at a glance
Guinea's certification demand comes from mining, fisheries, banking and an investment agency that promotes agriculture, infrastructure, energy, tourism and digital services as priority sectors. Law L/2016/037/AN, adopted in July 2016, covers cybersecurity and the protection of personal data, and says the data protection Authority is to be created by regulation. The national information-systems security agency, ANSSI, publishes a cybersecurity strategy for 2022-2027 that recommends institutions pursue ISO 27001 and PCI DSS certification, and it runs an accreditation portal for security service providers. The Central Bank of Guinea supervises banks, insurers and microfinance institutions, the Ministry of Fisheries, Aquaculture and Maritime Economy oversees the hygiene of fishery processing, and the Ministry of Mines and Geology manages mining titles and local content. Certificates for Guinean organisations usually carry accreditation from another economy within the international arrangements. Sterling's Casablanca office serves Guinean organisations, backed by 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Guinea
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Guinea (7)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi L/2016/037/AN relative à la cybersécurité et la protection des données à caractère personnel en République de Guinée The Authority in charge of the protection of personal data (Autorité en charge de la protection des données à caractère personnel), which Part 2 says is to be created by regulation; the same text refers to the competent Authority designated by regulation to receive declarations. The national cybersecurity strategy lists an Autorité de Protection des Données à Caractère Personnel (APDP) among the public bodies concerned. For cybersecurity the law involves the ministry in charge of posts, telecommunications and the digital economy and ARPT. | Part 2 covers collection, processing, transmission, storage and use of personal data by individuals, the State, local authorities, public bodies and private legal persons, automated or not, where the processing takes place in Guinea. Processing is declared in advance to the competent Authority, which issues a receipt, and may start on receipt. Declaration is waived for personal and household use, data whose publication a law prescribes, private registers and controllers that have appointed a data protection correspondent, except where a transfer to a third country is planned. Prior authorisation is needed for genetic and medical data and related research, offence and conviction data, national identification numbers and similar identifiers including telephone numbers, biometric data, public-interest processing and transfers to a third country. People have rights to information at collection, access, objection (free of charge for marketing), rectification, erasure and portability, and no decision may rest solely on automated profiling. Controllers must keep data confidential and secure, choose processors that give guarantees, and send the Authority an annual report. The Authority can warn, give notice, interrupt processing, withdraw authorisations and fine, and the law sets criminal penalties. Which body handles declarations in practice is for the ministry and counsel to confirm. | |
| Banque Centrale de la République de Guinée (BCRG) Banks, insurers, microfinance institutions and payment systems | The BCRG says the law gives it the task of safeguarding the stability of the financial system and that it supervises the banks, insurance companies and microfinance institutions operating in Guinea. Its site has a payment systems directorate and lists regulations on international transfers, on gold and precious-metal export proceeds and on foreign-currency payments to the BCRG, a global compliance policy, a personal data protection policy that cites Law L/2016/037/AN, and the composition of its anti-money-laundering committee (decision No. 094-2021-BCRG of 10 March 2021). The titles listed do not name an ISO standard or PCI DSS. | |
| Ministère de la Santé et de l'Hygiène publique (Ministry of Health and Public Hygiene) Medicines, laboratories, pharmacies and health establishments | The ministry states that its remit includes issuing authorisations and approvals to health establishments and the technical control of laboratories, pharmacies and care structures. Its site lists a Direction Nationale de la Pharmacie et du Médicament, a Direction Nationale des Laboratoires, a Direction Nationale de l'Hygiène Publique and a Laboratoire de Contrôle de Qualité des Médicaments, and names the Pharmacie centrale de Guinée and the Agence nationale de sécurité sanitaire among its autonomous public bodies. The pages do not name ISO 13485 or ISO/IEC 17025. | |
| Ministère de la Pêche, de l'Aquaculture et de l'Economie maritime (Ministry of Fisheries, Aquaculture and Maritime Economy) Fishing, aquaculture and fishery products | The ministry's stated remit includes quality control of hygiene and wholesomeness in production zones and in structures that process and preserve catches, surveillance of contaminants in aquatic environments, hygiene and safety norms in fishing ports and control of distribution channels for fishery products with other administrations. Among its autonomous public bodies it lists the Office national de contrôle sanitaire des produits de la pêche et de l'aquaculture and the Centre national de surveillance et de police des pêches. The pages do not name HACCP or ISO 22000. | |
| Ministère des Mines et de la Géologie (Ministry of Mines and Geology) Mining and quarrying | The ministry's remit page lists drafting mining and geology legislation, applying the local-content policy and corporate social responsibility in mining, overseeing the legislation on safe conditions for civil-use explosives with other administrations, monitoring the action plans of mining companies and projects, and examining the award, renewal and withdrawal of mining titles. The remit does not name an ISO standard. | |
| Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI), with the telecommunications and postal regulator ARPT Information systems security, telecommunications and electronic transactions | ANSSI is a public administrative body created by decree D 266/PRG/SGG/2016 of 29 August 2016 under the ministry in charge of posts, telecommunications and the digital economy. It lists risk assessment, audit and intrusion testing, digital forensics, crisis management and incident handling among its tasks, and its regulatory portal sets accreditation categories for providers of security audit, security consulting, incident detection, incident response, digital investigation, electronic trust services and PKI. The National Cybersecurity Policy and Strategy 2022-2027, published on ANSSI's site, includes an action to adopt a common risk method based on ISO 27005 and ISO 27002 and to recommend that institutions where it adds most value pursue certification of their information security management systems, naming ISO 27001 and PCI DSS, with awareness and technical assistance. | ISO/IEC 27001, PCI DSS |
| Agence de Promotion des Investissements Privés (APIP) Private investment | APIP presents the Investment Code adopted in May 2015, under which investors apply for an investment certificate on the PLAGED platform, with the file examined by APIP's Investment Code service and a review committee. It lists agriculture, infrastructure, mines, energy, tourism and ICT as priority sectors and promotes the Simandou programme. The pages do not make ISO certificates a condition. |
Accreditation and recognition
- No national accreditation body: The member list of the international accreditation arrangement (mutual recognition committee members, dated 31 December 2025; the arrangement passed to Global ACI on 1 January 2026) shows no accreditation body for Guinea, either as a signatory or as a non-signatory member.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Code des marchés publics (new Code of 17 December 2019, replacing the Code of November 2012) and the Direction Générale du Contrôle des Marchés Publics (Direction Générale du Contrôle des Marchés Publics, Ministère de l'Économie et des Finances): The Ministry of Economy and Finance lists the Direction Générale du Contrôle des Marchés Publics among its general directorates and runs a public-procurement section with the legal texts and the procurement code, circular letters, activity reports, the history of contracts, derogations and standard documents for terms of reference, requests for proposals and tender dossiers. Qualification criteria and the evidence required are set in each bidding document, so read the qualification clause of the tender you are bidding on.
Sterling in Guinea
Sterling delivers in Guinea from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Guinea clients ask
Does Guinea have a personal data protection law, and who oversees it?
Yes. Law L/2016/037/AN, adopted in July 2016, has a second part on personal data. It asks for prior declaration to the competent Authority, prior authorisation for sensitive categories and for transfers abroad, and it gives people rights of access, objection and correction. The law says the data protection Authority is to be created by regulation, so confirm with counsel which body receives declarations today.
Are certification audits in Guinea conducted in French?
Mostly, yes. Guinean laws, ministry pages and papers from ANSSI and the central bank appear in French, so it is the working language for reviewing documents, holding interviews and drawing up contracts. When you apply, fix the audit language, any interpreter and the language of controlled documents with the certification body, and flag a local language early.
Who checks the hygiene of fishery products in Guinea?
Responsibility lies with the fisheries ministry. Its stated remit includes hygiene and wholesomeness controls on production zones and on plants that treat and store catches, and its list of autonomous bodies includes an office for the health control of fishery and aquaculture products. Importers abroad may layer their own scheme demands over that official control.
Does Guinea's cybersecurity strategy mention ISO 27001?
Yes. ANSSI's published National Cybersecurity Policy and Strategy 2022-2027 contains an action that names ISO 27001 and PCI DSS when it recommends certified information security management systems for institutions where the benefit is greatest, backed by awareness work and technical assistance. That is strategy guidance rather than statute, so regulators and buyers still set their own proof.
Which authority supervises banks and payment firms in Guinea?
The Banque Centrale de la République de Guinée. It states that it supervises the banks, insurance companies and microfinance institutions operating in the country, runs a payment systems directorate and publishes a compliance policy and its own personal data protection policy. Its listed regulatory titles do not name an ISO standard, so certificates are a matter for your bank or partner.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi L/2016/037/AN relative à la cybersécurité et la protection des données à caractère personnel en République de Guinée — anssi.gov.gn; bcrg-guinee.org (accessed 18 Oct 2026)
- The BCRG says the law gives it the task of safeguarding the stability of the financial system and that it supervises the banks, insurance companies and microfinance institutions operating in Guinea. Its site has a payment systems directorate and lists regulations on international transfers, on gold and precious-metal export proceeds and on foreign-currency payments to the BCRG, a global compliance policy, a personal data protection policy that cites Law L/2016/037/AN, and the composition of its anti-money-laundering committee (decision No. 094-2021-BCRG of 10 March 2021). The titles listed do not name an ISO standard or PCI DSS. — bcrg-guinee.org (accessed 18 Oct 2026)
- The ministry states that its remit includes issuing authorisations and approvals to health establishments and the technical control of laboratories, pharmacies and care structures. Its site lists a Direction Nationale de la Pharmacie et du Médicament, a Direction Nationale des Laboratoires, a Direction Nationale de l'Hygiène Publique and a Laboratoire de Contrôle de Qualité des Médicaments, and names the Pharmacie centrale de Guinée and the Agence nationale de sécurité sanitaire among its autonomous public bodies. The pages do not name ISO 13485 or ISO/IEC 17025. — sante.gov.gn (accessed 18 Oct 2026)
- The ministry's stated remit includes quality control of hygiene and wholesomeness in production zones and in structures that process and preserve catches, surveillance of contaminants in aquatic environments, hygiene and safety norms in fishing ports and control of distribution channels for fishery products with other administrations. Among its autonomous public bodies it lists the Office national de contrôle sanitaire des produits de la pêche et de l'aquaculture and the Centre national de surveillance et de police des pêches. The pages do not name HACCP or ISO 22000. — peches.gov.gn (accessed 18 Oct 2026)
- The ministry's remit page lists drafting mining and geology legislation, applying the local-content policy and corporate social responsibility in mining, overseeing the legislation on safe conditions for civil-use explosives with other administrations, monitoring the action plans of mining companies and projects, and examining the award, renewal and withdrawal of mining titles. The remit does not name an ISO standard. — mines.gov.gn (accessed 18 Oct 2026)
- ANSSI is a public administrative body created by decree D 266/PRG/SGG/2016 of 29 August 2016 under the ministry in charge of posts, telecommunications and the digital economy. It lists risk assessment, audit and intrusion testing, digital forensics, crisis management and incident handling among its tasks, and its regulatory portal sets accreditation categories for providers of security audit, security consulting, incident detection, incident response, digital investigation, electronic trust services and PKI. The National Cybersecurity Policy and Strategy 2022-2027, published on ANSSI's site, includes an action to adopt a common risk method based on ISO 27005 and ISO 27002 and to recommend that institutions where it adds most value pursue certification of their information security management systems, naming ISO 27001 and PCI DSS, with awareness and technical assistance. — anssi.gov.gn (accessed 18 Oct 2026)
- APIP presents the Investment Code adopted in May 2015, under which investors apply for an investment certificate on the PLAGED platform, with the file examined by APIP's Investment Code service and a review committee. It lists agriculture, infrastructure, mines, energy, tourism and ICT as priority sectors and promotes the Simandou programme. The pages do not make ISO certificates a condition. — apip.gov.gn (accessed 18 Oct 2026)
- No national accreditation body — iaf.nu (accessed 23 Oct 2026)
- Code des marchés publics (new Code of 17 December 2019, replacing the Code of November 2012) and the Direction Générale du Contrôle des Marchés Publics — mef.gov.gn (accessed 23 Oct 2026)
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice