Where we work · Guyana
ISO and GRC certification consulting in Guyana
Achieve ISO and GRC certification in Guyana with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- New York office team
- Effivity and Academy included
Sectors that ask for certification in Guyana
Clients include
ISO and GRC certification in Guyana at a glance
Guyana's oil and gas supply chain, mines, farms, forests and growing services sector drive most demand for management system certification and compliance work, going by the sectors GO-Invest lists. Suppliers to the petroleum industry register with the Local Content Secretariat at the Ministry of Natural Resources under the Local Content Act No. 18 of 2021, while payment service firms apply to the Bank of Guyana under the National Payments System Act No. 13 of 2018. Food businesses answer to the Food and Drugs Act, projects need a permit from the Environmental Protection Agency, and employers work under the Occupational Safety and Health Act. The Data Protection Act 2023 is enacted as Act No. 18 of 2023, with a Data Protection Commissioner appointed under it. The Guyana National Bureau of Standards develops national standards, and certificates for management systems usually carry accreditation from another economy. Sterling's New York office serves Guyanese clients, on site where the work needs it and remotely otherwise, bringing 8,100+ client engagements in 60+ countries, 20+ years of practice, and Effivity and Sterling Academy included with the engagement. Accredited certification bodies issue the certificates, not Sterling.
ISO and GRC standards Sterling delivers in Guyana
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Guyana (7)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Data Protection Act 2023 (Act No. 18 of 2023) The Data Protection Commissioner appointed under the Act (the Bill as published creates the Commissioner in Part VII, with enforcement powers in Part VIII). | The Bill as published sets principles for lawful, fair, purpose-limited, accurate, minimised and secure processing; rights of access, rectification, erasure, restriction, portability and objection; rules for transfers outside Guyana; registers of data controllers and data processors kept by the Commissioner; data protection officers, impact assessments and breach notification; and an enforcement regime. | |
| Bank of Guyana Payment service providers and system operators | Payment Service Providers Guideline No. 2 (March 2025), issued under Part III of the National Payments System Act No. 13 of 2018. The Bank says it has statutory authority to license, regulate and oversee payment service providers and system operators. Applicants submit risk management policies covering security risk management, technology risk and the protection of customer data, incident management, and business continuity and disaster recovery plans, and they describe the information security systems they will use. The Guideline does not name ISO/IEC 27001, ISO 22301 or PCI DSS. | |
| Bank of Guyana Licensed financial institutions: risk management | Supervision Guideline No. 9 on Risk Management, issued under the Financial Institutions Act 1995 and dated 1 July 2009. It treats operational risk as arising from technology failures, internal control deficiencies, breakdowns and staff, and sets out how the Bank reviews risk management. It does not name ISO standards. | |
| Analysts and inspectors appointed by the Minister under the Food and Drugs Act (the Government Analyst, Food and Drug Department) Food, drugs, cosmetics and medical devices | Food and Drugs Act, Cap. 34:03 (Act 12 of 1971). Parts II to V prohibit the sale of harmful, unfit, adulterated or insanitary food, drugs, cosmetics and injurious devices and require food, drug and device standards to be maintained; section 20 lets the Minister appoint analysts and inspectors; inspectors may enter premises, take samples and examine imports. The Act does not name HACCP, ISO 22000 or ISO 13485. | |
| Environmental Protection Agency (EPA) Environmental permitting | Environmental Protection Act, Cap. 20:05. The EPA describes itself as Guyana's national environmental regulator, with permitting, monitoring and enforcement powers. Under section 11(1) a developer of a project listed in the Fourth Schedule, or of any project that may significantly affect the environment, applies for an environmental permit; the EPA screens the application, publishes its decision, and requires an environmental impact assessment with public consultation where one is needed. The Act does not name ISO 14001. | |
| Occupational Safety and Health Department, Ministry of Labour and Manpower Planning Workplace safety and health | Occupational Safety and Health Act (Act 32 of 1997, amended by Act 22 of 2009). Part I provides for the registration of industrial establishments, and the Act provides for joint workplace safety and health committees. The Department says its information, advisory, supervisory and regulatory services extend to workplaces in the formal and informal economy, and it publishes guidance for mining and construction. The Act does not name ISO 45001. | |
| Local Content Secretariat, Ministry of Natural Resources Petroleum-sector suppliers | Local Content Act No. 18 of 2021. The Secretariat is the focal point for monitoring, evaluation, coordination and reporting of local content in petroleum operations, and the Act prioritises Guyanese nationals and Guyanese companies in the procurement of goods and services. Suppliers register through the Secretariat's online portal for a Local Content Certificate; the published company requirements require incorporation, tax and National Insurance compliance, ownership, financial statements, an organisational chart and employee details, and do not list ISO certificates. |
Accreditation and recognition
- Guyana National Bureau of Standards (GNBS): National standards body; a statutory corporation governed by a National Standards Council, which its site says was established under Act No. 11 of 1984, with standards development, calibration, verification and testing among its listed services.
- CARICOM Regional Organization for Standards and Quality (CROSQ): Regional intergovernmental organisation, established in February 2002, that develops regional standards and promotes the harmonisation of metrology in the CARICOM Single Market and Economy; GNBS lists it among its affiliations.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Procurement Act 2003 (Cap. 73:05) and the National Procurement and Tender Administration (National Procurement and Tender Administration (NPTA), Ministry of Finance): Section 5 lets a procuring entity require suppliers and contractors to meet the qualification criteria it considers appropriate, including technical competence, managerial capability, reliability, experience and personnel, tax and social security compliance, and past performance. The NPTA publishes the Act, the Procurement Regulations and standard bidding documents. The Act does not name ISO certificates, so each tender sets its own evidence; read the bidding document before assuming that a certificate is needed.
- Local Content Certificate for petroleum-sector suppliers (Local Content Secretariat, Ministry of Natural Resources): Registration through the Secretariat's portal is the route into petroleum-sector procurement under the Local Content Act No. 18 of 2021; the requirements list shows corporate, tax, ownership, financial and workforce documents rather than management system certificates, while individual buyers set their own supplier-qualification questions.
Sterling in Guyana
Sterling delivers in Guyana from its New York office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Guyana clients ask
Does Guyana have a data protection law?
Yes. The Data Protection Act 2023 is Act No. 18 of 2023, which Parliament lists as passed on 9 August 2023 and gazetted on 16 August 2023. The Bill as published leaves its start to a ministerial order, with different days possible for different provisions, so ask the Commissioner or your counsel which provisions apply to your processing today.
Who supervises personal data under the Data Protection Act 2023?
The Act creates a Data Protection Commissioner, and the Digital Identity Card Registry's site says a Commissioner has been appointed under it. The Bill as published gives the Commissioner functions in Part VII and enforcement powers in Part VIII. Check the Commissioner's current guidance and forms before relying on any procedure.
Is there a Guyanese accreditation body for ISO certification bodies?
None appears on the IAAC or ILAC member lists. GNBS, the national standards body, develops standards and offers metrology services, and CROSQ plays a regional standards role. An ISO certificate for a Guyanese company usually carries accreditation from another economy, so ask your customer or regulator which accreditation it accepts before you choose a certification body.
Are certification audits in Guyana conducted in English?
Normally yes. The Acts, regulator guidelines, procurement documents and registration forms are in English, so controlled documents, records and staff interviews are usually in English too. Agree the audit language with the certification body at application, and mention early if any crew or shift interviews will use another language.
Which agency issues environmental permits in Guyana?
The Environmental Protection Agency issues them. Section 11(1) of the Environmental Protection Act obliges the developer of any Fourth Schedule project, or any project likely to affect the environment significantly, to apply for a permit, after which the Agency screens the application and can call for an impact assessment with public consultation. A management system standard never stands in for that permit.
Do petroleum-sector suppliers need ISO certificates to register with the Local Content Secretariat?
No ISO certificate appears in the Secretariat's published company requirements. They list incorporation, tax and National Insurance compliance, ownership, financial statements, an organisational chart and employee details. Operators and contractors may still ask their own suppliers for quality, safety or security evidence, so check each buyer's questionnaire.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act 2023 (Act No. 18 of 2023) — parliament.gov.gy; e-id.gov.gy; mola.gov.gy (accessed 18 Oct 2026)
- Payment Service Providers Guideline No. 2 (March 2025), issued under Part III of the National Payments System Act No. 13 of 2018. The Bank says it has statutory authority to license, regulate and oversee payment service providers and system operators. Applicants submit risk management policies covering security risk management, technology risk and the protection of customer data, incident management, and business continuity and disaster recovery plans, and they describe the information security systems they will use. The Guideline does not name ISO/IEC 27001, ISO 22301 or PCI DSS. — bankofguyana.org.gy (accessed 18 Oct 2026)
- Supervision Guideline No. 9 on Risk Management, issued under the Financial Institutions Act 1995 and dated 1 July 2009. It treats operational risk as arising from technology failures, internal control deficiencies, breakdowns and staff, and sets out how the Bank reviews risk management. It does not name ISO standards. — bankofguyana.org.gy (accessed 18 Oct 2026)
- Food and Drugs Act, Cap. 34:03 (Act 12 of 1971). Parts II to V prohibit the sale of harmful, unfit, adulterated or insanitary food, drugs, cosmetics and injurious devices and require food, drug and device standards to be maintained; section 20 lets the Minister appoint analysts and inspectors; inspectors may enter premises, take samples and examine imports. The Act does not name HACCP, ISO 22000 or ISO 13485. — moha.gov.gy (accessed 18 Oct 2026)
- Environmental Protection Act, Cap. 20:05. The EPA describes itself as Guyana's national environmental regulator, with permitting, monitoring and enforcement powers. Under section 11(1) a developer of a project listed in the Fourth Schedule, or of any project that may significantly affect the environment, applies for an environmental permit; the EPA screens the application, publishes its decision, and requires an environmental impact assessment with public consultation where one is needed. The Act does not name ISO 14001. — epaguyana.org (accessed 18 Oct 2026)
- Occupational Safety and Health Act (Act 32 of 1997, amended by Act 22 of 2009). Part I provides for the registration of industrial establishments, and the Act provides for joint workplace safety and health committees. The Department says its information, advisory, supervisory and regulatory services extend to workplaces in the formal and informal economy, and it publishes guidance for mining and construction. The Act does not name ISO 45001. — labour.gov.gy (accessed 18 Oct 2026)
- Local Content Act No. 18 of 2021. The Secretariat is the focal point for monitoring, evaluation, coordination and reporting of local content in petroleum operations, and the Act prioritises Guyanese nationals and Guyanese companies in the procurement of goods and services. Suppliers register through the Secretariat's online portal for a Local Content Certificate; the published company requirements require incorporation, tax and National Insurance compliance, ownership, financial statements, an organisational chart and employee details, and do not list ISO certificates. — localcontent.gov.gy; petroleum.gov.gy (accessed 18 Oct 2026)
- Guyana National Bureau of Standards (GNBS) — gnbsgy.com; iaac.org.mx; ilac.org (accessed 18 Oct 2026)
- CARICOM Regional Organization for Standards and Quality (CROSQ) — gnbsgy.com; iaac.org.mx (accessed 18 Oct 2026)
- Procurement Act 2003 (Cap. 73:05) and the National Procurement and Tender Administration — npta.gov.gy (accessed 18 Oct 2026)
- Local Content Certificate for petroleum-sector suppliers — localcontent.gov.gy; petroleum.gov.gy (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the New York team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice