Where we work · Lesotho
ISO and GRC certification consulting in Lesotho
Achieve ISO and GRC certification in Lesotho with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Johannesburg office team
- Effivity and Academy included
Sectors that ask for certification in Lesotho
Clients include
ISO and GRC certification in Lesotho at a glance
Statutes at home and buyers abroad shape Lesotho's compliance picture. The Data Protection Act, 2011 establishes a Data Protection Commission and asks controllers to secure personal information and report security compromises as soon as reasonably possible. The Lesotho Communications Authority licenses operators under the Communications Act No. 4 of 2012, the Central Bank supervises banks, insurers, pension funds and payment providers, and the Department of Environment gives clearance under the Environment Act, 2008. LNDC lists clothing, footwear, automotive components, electrical products, diamonds, trout and fruit among its priorities and offers industrial property, including the Ha Belo and Ha Tikoe estates, to manufacturers. SADCAS, based in Gaborone, accredits for Lesotho, which has no national accreditation body of its own; accredited certification bodies issue certificates and Sterling does not. From its Johannesburg office, Sterling works with Lesotho clients on site where the work needs it and remotely otherwise, bringing 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in Lesotho
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Lesotho (7)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Data Protection Act, 2011 (Act No. 5 of 2012) Data Protection Commission, established by section 6 of the Act, with a chairperson and five other members appointed by the Prime Minister on the advice of the Minister | Sets principles for processing personal information: lawful grounds including explicit consent, minimality, collection directly from the data subject, specified purposes, limited retention and destruction in a way that prevents reconstruction. Controllers must secure the integrity of personal information, bind agents by written contract, notify the Commission and affected people of security compromises as soon as reasonably possible, notify the Commission of their processing, give access and correction rights and restrict sensitive information. Transfers outside Lesotho are limited by section 52, and the Act creates offences. | |
| Lesotho Communications Authority (LCA) Telecommunications, broadcasting and postal licensees | Communications Act No. 4 of 2012, which the Authority says commenced on 27 April 2012 under Legal Notice No. 58 of 2012 — the Authority, a statutory body established in June 2000, grants licences, promotes fair competition and issues rules, including the Licensing Classification and Fees Rules and the Quality of Service Rules, 2023; its site also carries a cyber security section and a COMCSIRT section. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 |
| Central Bank of Lesotho Banks, insurers, pension funds, lenders and payment providers | Central Bank of Lesotho Act, 2000, Financial Institutions Act, 2012, Insurance Act, 2014, Pension Funds Act, 2019, Credit Reporting Act, 2011 and Payment Systems Act, 2014 — the Bank says it supervises banks and non-banks through offsite review of prudential and risk management returns and onsite examinations, and oversees, inspects and monitors payment and settlement systems and licenses payment system operators and service providers. | PCI DSS, ISO/IEC 27001, ISO 22301, SOC 2 |
| Department of Environment, within the Ministry of Environment and Forestry (formerly the National Environment Secretariat) Projects needing environmental clearance, and sources of pollution and hazardous waste | Environment Act, 2008 (Act No. 10 of 2008) — the Department says it reviews environmental impact statements, gives environmental clearance for projects that need an assessment, inspects pollution sources, facilitates safe collection and disposal of hazardous waste and develops pollution control standards; the Act has parts on impact assessment, audit and monitoring, environmental quality standards and pollution control. | ISO 14001 |
| Labour Code Order, 1992 (Ordinance 24 of 1992) Employers and workplaces | Part VII, Health, safety and welfare at work — sections on duties of employers, employees and designers or importers, safety and health officers and committees, prohibition orders, notification of industrial accidents and diseases, protective equipment and registration of factories. | ISO 45001 |
| Ministry of Trade, Industry, Business Development and Tourism Manufacturers, exporters and traders | The Ministry lists manufacturing licences, business licensing and registration, export visas and business inspection among its services, and among its objectives strengthening quality infrastructure and developing standardisation, metrology, conformity assessment and accreditation institutions. | ISO 9001 |
| Lesotho National Development Corporation (LNDC) Investors and industrial tenants | LNDC says it facilitates and invests in businesses and value chains, offers financing, investment support and industrial property, and lists key sectors including manufacturing, agriculture and agroprocessing, mining, energy and tourism; its pages do not ask for ISO certificates. | ISO 9001 |
Accreditation and recognition
- Southern African Development Community Accreditation Services (SADCAS): Multi-economy accreditation body, registered in 2005 under the Botswana Companies Act, 2003 and approved by the SADC Council of Ministers in August 2007, with its headquarters in Gaborone; SADCAS names Lesotho among the SADC states without a national accreditation body that it serves.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Economic zones
- Ha Belo Industrial Estate (Botha-Bothe district): factory shells for manufacturing tenants
- Ha Tikoe Industrial Estate (Maseru district): factory shells for manufacturing tenants
Sterling in Lesotho
Sterling delivers in Lesotho from its Johannesburg office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Lesotho clients ask
Does Lesotho have a national accreditation body?
Not at present: the SADC protocol set up SADCAS so that states lacking their own body share one, and SADCAS lists Lesotho among those it serves from Gaborone. Its management system scheme carries international recognition for quality, environment, occupational health and safety and food safety, and Lesotho laboratories appear on its register. Check the mark and scope on any certificate before relying on it.
Which law protects personal data in Lesotho, and who regulates it?
The Data Protection Act, 2011, printed in the Government Gazette of 22 February 2012 as Act No. 5 of 2012. Section 6 establishes the Data Protection Commission. Controllers must secure personal information, bind their agents by written contract, notify the Commission of their processing and report security compromises as soon as reasonably possible. Confirm the Commission's current practice with your counsel.
Who regulates communications and cyber security activity in Lesotho?
The Lesotho Communications Authority, a statutory body established in June 2000, regulates the communications sector under the Communications Act No. 4 of 2012. It grants licences, promotes fair competition and issues rules such as the Quality of Service Rules, 2023, and its site carries a cyber security section. Ask the Authority what applies to your licence class.
Which agency gives environmental clearance for a new project in Lesotho?
The Department of Environment, within the Ministry of Environment and Forestry. It reviews environmental impact statements and gives environmental clearance for projects that need an assessment under the Environment Act, 2008, and it inspects pollution sources. An ISO 14001 certificate does not replace that clearance, so start with the Department when a project may need an assessment.
What does Lesotho export, and what does that mean for supplier standards?
LNDC lists water, clothing and garments, diamonds, wool and mohair, trout, deciduous fruit, leatherworks, car seat covers and circuit breakers among the main export commodities. Overseas and South African buyers therefore set most quality, environmental, safety and food safety requirements for suppliers, and the Trade Ministry lists quality infrastructure among its objectives. Ask each buyer which certificates it accepts.
In which language are audits carried out in Lesotho?
Mostly English. The Gazette that prints the Data Protection Act, the Central Bank and the Communications Authority all publish in it, so documents are usually English, although operators and workers on garment lines, farms and mine sites may prefer Sesotho. Settle the audit language, interpreter arrangements and controlled-document language with your certification body when you apply.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act, 2011 (Act No. 5 of 2012) — centralbank.org.ls; lesotholii.org (accessed 18 Oct 2026)
- Communications Act No. 4 of 2012, which the Authority says commenced on 27 April 2012 under Legal Notice No. 58 of 2012 — lca.org.ls (accessed 18 Oct 2026)
- Central Bank of Lesotho Act, 2000, Financial Institutions Act, 2012, Insurance Act, 2014, Pension Funds Act, 2019, Credit Reporting Act, 2011 and Payment Systems Act, 2014 — centralbank.org.ls (accessed 18 Oct 2026)
- Environment Act, 2008 (Act No. 10 of 2008) — environment.gov.ls; lesotholii.org (accessed 18 Oct 2026)
- Part VII, Health, safety and welfare at work — lesotholii.org (accessed 18 Oct 2026)
- The Ministry lists manufacturing licences, business licensing and registration, export visas and business inspection among its services, and among its objectives strengthening quality infrastructure and developing standardisation, metrology, conformity assessment and accreditation institutions — gov.ls (accessed 18 Oct 2026)
- LNDC says it facilitates and invests in businesses and value chains, offers financing, investment support and industrial property, and lists key sectors including manufacturing, agriculture and agroprocessing, mining, energy and tourism; its pages do not ask for ISO certificates — lndc.org.ls (accessed 18 Oct 2026)
- Southern African Development Community Accreditation Services (SADCAS) — sadcas.org (accessed 18 Oct 2026)
- Ha Belo Industrial Estate (Botha-Bothe district) — lndc.org.ls (accessed 18 Oct 2026)
- Ha Tikoe Industrial Estate (Maseru district) — lndc.org.ls (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice