Where we work · Jordan

ISO and GRC certification consulting in Jordan

Achieve ISO and GRC certification in Jordan with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.

Request a discovery call See all 21 standards

21 standards, one team
Accredited certification route
Dubai office team
Effivity and Academy included

Sectors that ask for certification in Jordan

Banks, payment firms and fintechs
IT, outsourcing and software exporters
Pharmaceutical, medical device and cosmetics makers
Food and beverage manufacturers and exporters
Government and public-sector suppliers
Construction, mining and industrial contractors

Clients include

Talk to the Dubai office

We call youA Sterling consultant replies within one working day.
Scope and proposalAgreed on the call; no proposal before the scope is clear.
CertificationOne team takes you through to the independent audit.

In short

ISO and GRC certification in Jordan at a glance

Jordan's data protection regime is now live: the Personal Data Protection Law No. (24) of 2023 came into effect on 17 March 2024, with a Personal Data Protection Council chaired by the Minister of Digital Economy and Entrepreneurship and a Directorate that keeps the registry and takes complaints. Around it sit the Central Bank of Jordan's cyber risk instructions and financial sector framework, the National Cyber Security Center created by the Cyber Security Law of 2019, the Jordan Food and Drug Administration, the Jordan Standards and Metrology Organization and the Government Tenders Department, which buys works and technical services through its electronic system. Certificates come from accredited certification bodies, never from Sterling, and Jordan's accreditation unit, JAS-AU, is an ILAC signatory for laboratories and inspection. Demand comes from banks and fintechs, software and outsourcing exporters, pharmaceutical and medical device makers, food producers, public-sector suppliers, contractors and the Aqaba zone. Sterling's Dubai office serves clients in Jordan on-site where the work needs it and remotely otherwise, bringing 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.

Explore

ISO and GRC standards Sterling delivers in Jordan

Each page covers who needs the standard in Jordan, its requirements, how to get it, what sets the time and cost, and the local laws behind it.

Regulators and laws that drive certification in Jordan (12)

Law or regulator	What it asks for	Standards it cites
Personal Data Protection Law No. (24) of 2023 (PDPL) Personal Data Protection Council, chaired by the Minister of Digital Economy and Entrepreneurship, with the Personal Data Protection Directorate (the Unit) in the Ministry of Digital Economy and Entrepreneurship (MoDEE) as its operating arm	Applies to Data (Personal Data and Sensitive Personal Data) even if collected or processed before the Law took effect, and does not apply to natural persons processing their own data for personal purposes (Article 3). A Controller is any natural or legal person, inside or outside the Kingdom, who has the Data in their custody (Article 2); MoDEE's FAQ describes the territorial scope as the personal data of citizens and residents within Jordan and the material scope as natural persons, not companies. Prior Consent must be explicit, specific as to duration and purpose, and requested in clear language (Article 5), with listed exceptions for public entities, medical care, vital interests, crime prevention, legal requirements, entities supervised by the Central Bank of Jordan, research, statistics and publicly available data (Article 6). Data subjects have rights to know and access, withdraw consent, correct, restrict, erase or conceal, object to processing and profiling, move a copy and be told of breaches (Article 4). Controllers must protect Data, run complaint procedures, inform data subjects before processing (Articles 8 and 9), and erase or hide Data in listed cases (Article 10). A Data Protection Officer is required where the primary activity is processing Personal Data, or the processing covers Sensitive Personal Data, the Data of persons lacking legal capacity, financial information or transfers of databases outside the Kingdom, or where the Council so decides (Article 11). Transfers to recipients are conditioned (Article 14), and transfers outside the Kingdom to a lower level of protection are barred except in listed cases, with the Controller checking the recipient's protection level first (Article 15). Where a breach is likely to cause severe harm the Controller notifies affected data subjects within 24 hours of discovery and reports to the Unit within 72 hours (Article 20). The Unit keeps a registry of Controllers, Processors and Data Protection Officers (Article 18). Entities already handling Data were to conform within no more than one year of entry into force (Article 23). Penalties are set in Articles 21 and 22 and are not restated here. The Law cites no ISO standard.
Security, Technical and Organizational Measures Instructions of the year 2025 Personal Data Protection Council and the Personal Data Protection Directorate, MoDEE	Requires controllers to apply physical, technical and organisational measures in proportion to the nature, scope and importance of the processing: secured premises and entry control, backups kept in a secure place, protection against leakage and hacking, a technical check at least once a year to assess vulnerabilities, encryption or encoding in transit and storage where needed, restoration and availability of databases and backups, role-based permissions, data protection policies, data minimisation and retention limits, staff training, documented processing, identity checks before access or erasure requests, and incident response plans consistent with the National Cyber Security Center's procedures. A Data Protection Impact Assessment is required when sensitive personal data is processed or data is transferred outside the Kingdom, kept by the controller and updated at least once a year. Contracts with processors and recipients must define purpose, duration, scope, retention, breach reporting, erasure or return, and sub-processors. The instructions name no ISO standard.
Other PDPL regulations, instructions, guidelines and forms published by MoDEE Personal Data Protection Directorate, MoDEE	MoDEE's services page says a complainant must first complain to the entity concerned and may then escalate to the Directorate, which investigates and recommends action to the Council, and it provides access to the registry of Data Protection Officers, Data Processors and Data Controllers and an accreditation form for Data Protection Officers. Further instruments and guides that MoDEE's presentation lists as planned or in draft are not relied on here.
Central Bank of Jordan (CBJ) Banks, financial institutions, credit bureaus, microfinance companies and payment firms	Instructions of Cyber Risks Resilience, No. 26/1/1/1984 dated 6 February 2018 (apply to licensed banks, financial institutions, credit bureaus and microfinance companies under CBJ oversight; they require governance, a cyber security programme and policy, risk assessment, protection controls, detection, and response and recovery, and an information security manager independent of the IT department). The Cybersecurity Framework for Jordan Financial Sector, Version 1.0 (cover dated July 2021, page headers April 2021), is owned by CBJ and assessed by its Financial Cyber Emergency Response Team (FinCERT); its baselines were guided by NIST, ISO, PCI, SWIFT and ISACA material, it lists PCI DSS among the international standards entities should comply with, and it gives ISO 27001 Lead Implementer as one example of a professional certificate for the accountable cybersecurity head. The framework also lists the Instructions on Business Continuity Planning no. (27/2006), the Instructions on Governance and Management of Information and Information Technology no. (65/2016), the Electronic Transactions Law no. (15) of 2015 and the Bylaw of Electronic Payment and Money Transfer no. (111) of 2017 among national regulations. CBJ's Artificial Intelligence Framework for the Banking Sector in Jordan, Version 1.0 (July 2025), applies to CBJ-regulated banking institutions and encourages adoption of international practice such as ISO/IEC standards for AI risk management, information security and quality control.	PCI DSS
National Cyber Security Center (NCSC), with the National Cyber Security Council National cyber security, critical infrastructure, government contractors and cloud services	Cyber Security Law No. (16) of 2019 (unofficial translation on NCSC's site) creates the Council, which approves cybersecurity strategies, policies and standards, and the Center, a government body with legal personality linked to the Prime Minister and based in Amman, which prepares strategies, policies and standards, defines cybersecurity standards and controls, classifies incidents and grants licences to cybersecurity service providers under a regulation (the Law defines cybersecurity services to include security assessment, monitoring, auditing and advisory services). NCSC's legislation page also lists the Cybercrimes Law 2023, the Personal Data Protection Law 2023, a Regulation for licensing cybersecurity service providers and instructions on incident classification. NCSC publishes the Jordan National Cybersecurity Framework with an activity and control mapping that sets ISO 27002 control references beside NIST 800-53, Critical Infrastructure Cyber Security Controls (CICSC) guidance and a mapping annex dated December 2024, a Cyber Security Policy for Cloud Computing Services (2025), and, on its security standards page, 'Cyber security standards and controls for entities contracting with ministries and government departments 2023' (the document itself is not summarised here).	ISO/IEC 27001
Jordan Food and Drug Administration (JFDA), Food Directorate Food manufacturers, importers and exporters	JFDA's own text says the General Organization for Food and Drug was established by Temporary Law No. (31) of 2003 and that the permanent law, No. (41) of 2008, was approved. The Food Directorate's published tasks include granting health certificates for export of locally produced food, preventing circulation or entry of food found not to meet technical rules or health measures, taking part in setting national food standards, conformity assessment of food against standards and technical rules, and monitoring the application of good manufacturing practice and the hazard analysis and critical control points system in food handling.	HACCP
Jordan Food and Drug Administration (JFDA), Medical Devices and Supplies Directorate Medical device, supply and cosmetic makers and importers	The directorate was set up as a separate directorate in 2012. Its published tasks include registering and monitoring imported and locally produced medical devices and supplies under the 'bases for importing and circulating medical supplies, including sterilisers and disinfectants, 2019', registering cosmetics under the 2016 bases, sampling and laboratory testing of products on the market, issuing free-sale certificates to ease export, and inspecting local factories to ensure they apply good manufacturing practice principles. The directorate's page does not name ISO 13485.
Jordan Standards and Metrology Organization (JSMO) Standards, metrology, product conformity and market surveillance	JSMO's own site says it was established as a public organisation with financial and administrative autonomy under Law No. 22 for the Year 2000 and its amendments. Its objectives include a national standardisation and metrology system, accreditation of laboratories and of certification and inspection bodies, and compliance of goods, products and services with the technical regulations it adopts. Its departments cover standardisation, metrology (calibration of measuring instruments and verification of legal measuring instruments), inspection of local markets and factories, border control of imported goods and precious metals hallmarking. It also owns the JO-Ecolabel scheme, which its site ties to ISO 14024.
Ministry of Labour; Social Security Corporation (SSC) Employers and workplaces (occupational safety and health)	Labor Law No. (8) of 1996; the Regulation on Occupational Safety and Health and Prevention of Occupational Hazards in Institutions No. (31) of 2023; a 2024 decision of the Minister of Labor, issued under article 7 of that Regulation, approving an occupational safety and health policy form for employers with twenty or more workers (the policy must set out management commitment, roles and responsibilities, risk assessment, consultation with workers and training, and be displayed in the workers' languages); and Instructions of the year 2023 on identifying sources of occupational hazards, issued under article 79 of the Labor Law. SSC published an Occupational Safety and Health Strategy for the Prevention and Reduction of Work Accidents and Injuries 2023-2027. None of these texts names ISO 45001.
Ministry of Environment Industry and any activity affecting the environment	Environment Protection Law No. (6) of 2017 and the Environmental Classification & Licensing Regulation No. (69) of 2020, made under clause A of article 5 of that Law and taking effect after a period the Regulation sets from its publication in the Official Gazette; it covers environmental classification, consent and licensing of projects and uses an Environmental Impact Assessment Committee. The Regulation's text does not name ISO 14001.
Ministry of Energy and Mineral Resources (MEMR) Energy users and energy-service providers	Renewable Energy & Energy Efficiency Law No. (13) of 2012; the Third National Energy Efficiency Action Plan 2024-2026, which sets 50 sectoral and cross-sectoral measures, intensifies energy audits in industry and cites energy management system projects in the water sector; instructions for licensing energy audit service providers (2017, under By-law 73 of 2012); and the Jordanian standards JS 2243 (1-5): 2019 on energy audits developed by JSMO. The Action Plan does not name ISO 50001 as a requirement.
Integrity and Anti-Corruption Commission (JIACC) Public and private bodies exposed to bribery and corruption	JIACC's own history page says Jordan ratified the UN Convention against Corruption in 2005, issued Anti-Corruption Commission Law No. (62) of 2006 (amended in 2012 and 2014) and then the Integrity and Anti-Corruption Law No. (13) of 2016, which merged the Anti-Corruption Commission and the Ombudsman Bureau into one commission. The Government Tenders Department's site carries a 'Report a Bribe' page. Neither source names ISO 37001.

Accreditation and recognition

Jordan Accreditation System – Accreditation Unit (JAS-AU): National accreditation body — JSMO's site refers to the Jordan Accreditation System (JAS-AU) as the body that nationally accredits its own certification department, and JSMO states that accreditation of laboratories and of certification and inspection bodies is one of its objectives; ILAC and the multilateral recognition arrangement list it as 'Jordan Accreditation & Standardization Systems – Accreditation Unit'.

Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.

Tenders and procurement

Government works and technical-services purchasing, and the JONEPS electronic purchasing system (Government Tenders Department (GTD)): GTD's site says it manages the procedures for purchasing works and technical services, publishes tenders under offering, laws, regulations, instructions and forms, runs the Electronic Purchasing System (JONEPS) and publishes contractor classification and licensing forms and a 'Report a Bribe' page. Its published pages describe procedures and forms and do not state a general ISO certificate requirement; any certificate requirement sits in the individual tender document.
Cyber security standards and controls for entities contracting with ministries and government departments (2023) (National Cyber Security Center (NCSC)): NCSC's security standards page lists a document with this title, so suppliers to ministries and government departments should read it for the controls that apply to their contracts; this record does not summarise its content.

Economic zones

Aqaba Special Economic Zone, administered by the Aqaba Special Economic Zone Authority (ASEZA): port and logistics, tourism, industry, services

Sterling in Jordan

Sterling delivers in Jordan from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.

Requirements, clause by clause

What the standards require, clause by clause

Before you start in Jordan, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.

Questions Jordanian clients ask

Is Jordan's Personal Data Protection Law in force, and who regulates it?

Yes. Ministry of Digital Economy and Entrepreneurship guidance states the Personal Data Protection Law No. (24) of 2023 came into effect on 17 March 2024. A Personal Data Protection Council chaired by the Minister regulates it, supported by a directorate in the Ministry that handles complaints, the registry and compliance monitoring. Check your own obligations with counsel or the Directorate.

Which accreditation should a certification body hold for management system certificates in Jordan?

Ask the certification body to show its accreditation certificate and scope. Jordan's accreditation unit, JAS-AU, is an ILAC signatory for testing, calibration, medical testing and inspection, while the recognition arrangement's member list dated 31 December 2025 shows it with a product certification scope only. For ISO management system certificates, check which accreditation body stands behind the body you choose.

Do Jordanian banks have to follow specific cyber security rules?

Yes. Licensed banks, financial institutions, credit bureaus and microfinance companies fall under the Central Bank's Instructions of Cyber Risks Resilience from February 2018, and the Bank also owns a Cybersecurity Framework for the financial sector that names PCI DSS among the standards entities should follow. Read the current texts with the Central Bank for your licence type.

Which authority supervises food and medical device businesses in Jordan?

The Jordan Food and Drug Administration. Its Food Directorate issues export health certificates and monitors good manufacturing practice and HACCP in food handling, and its Medical Devices and Supplies Directorate registers medical devices, supplies and cosmetics and inspects local factories. Confirm the registration route for your product with the Administration before planning certification.

Can certification audits in Jordan be conducted in English?

Often, because English is common in banking, technology, pharmaceutical and export firms, but laws and regulator instructions are issued in Arabic and shop-floor interviews are usually in Arabic. Agree the audit language, any interpreter and the language of controlled documents with the certification body at application, and follow any Arabic rule set by a regulator or government buyer.

Next step

Start with a free discovery call

A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.

Book a discovery call

Sources

Personal Data Protection Law No. (24) of 2023 (PDPL) — modee.gov.jo (accessed 11 Oct 2026)
Security, Technical and Organizational Measures Instructions of the year 2025 — modee.gov.jo (accessed 11 Oct 2026)
Other PDPL regulations, instructions, guidelines and forms published by MoDEE — modee.gov.jo (accessed 11 Oct 2026)
Instructions of Cyber Risks Resilience, No. 26/1/1/1984 dated 6 February 2018 (apply to licensed banks, financial institutions, credit bureaus and microfinance companies under CBJ oversight; they require governance, a cyber security programme and policy, risk assessment, protection controls, detection, and response and recovery, and an information security manager independent of the IT department). The Cybersecurity Framework for Jordan Financial Sector, Version 1.0 (cover dated July 2021, page headers April 2021), is owned by CBJ and assessed by its Financial Cyber Emergency Response Team (FinCERT); its baselines were guided by NIST, ISO, PCI, SWIFT and ISACA material, it lists PCI DSS among the international standards entities should comply with, and it gives ISO 27001 Lead Implementer as one example of a professional certificate for the accountable cybersecurity head. The framework also lists the Instructions on Business Continuity Planning no. (27/2006), the Instructions on Governance and Management of Information and Information Technology no. (65/2016), the Electronic Transactions Law no. (15) of 2015 and the Bylaw of Electronic Payment and Money Transfer no. (111) of 2017 among national regulations. CBJ's Artificial Intelligence Framework for the Banking Sector in Jordan, Version 1.0 (July 2025), applies to CBJ-regulated banking institutions and encourages adoption of international practice such as ISO/IEC standards for AI risk management, information security and quality control. — cbj.gov.jo (accessed 11 Oct 2026)
Cyber Security Law No. (16) of 2019 (unofficial translation on NCSC's site) creates the Council, which approves cybersecurity strategies, policies and standards, and the Center, a government body with legal personality linked to the Prime Minister and based in Amman, which prepares strategies, policies and standards, defines cybersecurity standards and controls, classifies incidents and grants licences to cybersecurity service providers under a regulation (the Law defines cybersecurity services to include security assessment, monitoring, auditing and advisory services). NCSC's legislation page also lists the Cybercrimes Law 2023, the Personal Data Protection Law 2023, a Regulation for licensing cybersecurity service providers and instructions on incident classification. NCSC publishes the Jordan National Cybersecurity Framework with an activity and control mapping that sets ISO 27002 control references beside NIST 800-53, Critical Infrastructure Cyber Security Controls (CICSC) guidance and a mapping annex dated December 2024, a Cyber Security Policy for Cloud Computing Services (2025), and, on its security standards page, 'Cyber security standards and controls for entities contracting with ministries and government departments 2023' (the document itself is not summarised here). — ncsc.jo (accessed 11 Oct 2026)
JFDA's own text says the General Organization for Food and Drug was established by Temporary Law No. (31) of 2003 and that the permanent law, No. (41) of 2008, was approved. The Food Directorate's published tasks include granting health certificates for export of locally produced food, preventing circulation or entry of food found not to meet technical rules or health measures, taking part in setting national food standards, conformity assessment of food against standards and technical rules, and monitoring the application of good manufacturing practice and the hazard analysis and critical control points system in food handling. — jfda.jo (accessed 11 Oct 2026)
The directorate was set up as a separate directorate in 2012. Its published tasks include registering and monitoring imported and locally produced medical devices and supplies under the 'bases for importing and circulating medical supplies, including sterilisers and disinfectants, 2019', registering cosmetics under the 2016 bases, sampling and laboratory testing of products on the market, issuing free-sale certificates to ease export, and inspecting local factories to ensure they apply good manufacturing practice principles. The directorate's page does not name ISO 13485. — jfda.jo (accessed 11 Oct 2026)
JSMO's own site says it was established as a public organisation with financial and administrative autonomy under Law No. 22 for the Year 2000 and its amendments. Its objectives include a national standardisation and metrology system, accreditation of laboratories and of certification and inspection bodies, and compliance of goods, products and services with the technical regulations it adopts. Its departments cover standardisation, metrology (calibration of measuring instruments and verification of legal measuring instruments), inspection of local markets and factories, border control of imported goods and precious metals hallmarking. It also owns the JO-Ecolabel scheme, which its site ties to ISO 14024. — jsmo.gov.jo (accessed 11 Oct 2026)
Labor Law No. (8) of 1996; the Regulation on Occupational Safety and Health and Prevention of Occupational Hazards in Institutions No. (31) of 2023; a 2024 decision of the Minister of Labor, issued under article 7 of that Regulation, approving an occupational safety and health policy form for employers with twenty or more workers (the policy must set out management commitment, roles and responsibilities, risk assessment, consultation with workers and training, and be displayed in the workers' languages); and Instructions of the year 2023 on identifying sources of occupational hazards, issued under article 79 of the Labor Law. SSC published an Occupational Safety and Health Strategy for the Prevention and Reduction of Work Accidents and Injuries 2023-2027. None of these texts names ISO 45001. — mol.gov.jo; ssc.gov.jo (accessed 11 Oct 2026)
Environment Protection Law No. (6) of 2017 and the Environmental Classification & Licensing Regulation No. (69) of 2020, made under clause A of article 5 of that Law and taking effect after a period the Regulation sets from its publication in the Official Gazette; it covers environmental classification, consent and licensing of projects and uses an Environmental Impact Assessment Committee. The Regulation's text does not name ISO 14001. — moenv.gov.jo (accessed 11 Oct 2026)
Renewable Energy & Energy Efficiency Law No. (13) of 2012; the Third National Energy Efficiency Action Plan 2024-2026, which sets 50 sectoral and cross-sectoral measures, intensifies energy audits in industry and cites energy management system projects in the water sector; instructions for licensing energy audit service providers (2017, under By-law 73 of 2012); and the Jordanian standards JS 2243 (1-5): 2019 on energy audits developed by JSMO. The Action Plan does not name ISO 50001 as a requirement. — memr.gov.jo; jreeef.memr.gov.jo (accessed 11 Oct 2026)
JIACC's own history page says Jordan ratified the UN Convention against Corruption in 2005, issued Anti-Corruption Commission Law No. (62) of 2006 (amended in 2012 and 2014) and then the Integrity and Anti-Corruption Law No. (13) of 2016, which merged the Anti-Corruption Commission and the Ombudsman Bureau into one commission. The Government Tenders Department's site carries a 'Report a Bribe' page. Neither source names ISO 37001. — jiacc.gov.jo; gtd.gov.jo (accessed 11 Oct 2026)
Jordan Accreditation System – Accreditation Unit (JAS-AU) — ilac.org; iaf.nu; jsmo.gov.jo (accessed 11 Oct 2026)
Government works and technical-services purchasing, and the JONEPS electronic purchasing system — gtd.gov.jo (accessed 11 Oct 2026)
Cyber security standards and controls for entities contracting with ministries and government departments (2023) — ncsc.jo (accessed 11 Oct 2026)
Aqaba Special Economic Zone, administered by the Aqaba Special Economic Zone Authority (ASEZA) — aseza.jo

Talk to a consultant

Plan your certification with the Dubai team.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

uae@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Get certified to a standard for the first timeUnderstand cost, scope and timingAdd a standard, or integrate the systems we haveArrange a meeting at the Dubai office

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice

Request a call Call Dubai

End to end, from one team

On every engagement, in every country

Multi-country programmes

100% success guarantee · 8,100+ client engagements in 60+ countries · since 2003

ISO and GRC certification consulting in Jordan

ISO and GRC certification in Jordan at a glance

ISO and GRC standards Sterling delivers in Jordan

Quality & operational excellence

Information security, cyber & cloud

Privacy & data protection

AI governance & digital trust

Environment, energy & climate

Health & safety

Governance, risk & resilience

Financial services, payments & AML

Food safety & agriculture

Healthcare, medical devices & life sciences

Laboratories, inspection & accreditation

Automotive, aerospace, rail & defence

Construction, energy, oil & gas