Where we work · Madagascar
ISO and GRC certification consulting in Madagascar
Achieve ISO and GRC certification in Madagascar with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Johannesburg office team
- Effivity and Academy included
Sectors that ask for certification in Madagascar
Clients include
ISO and GRC certification in Madagascar at a glance
One statute and one commission set the tone for compliance work in Madagascar. Loi n° 2014-038 on the protection of personal data makes organisations declare processing to the Commission Malagasy de l'Informatique et des Libertés, appoint a data protection delegate and seek authorisation before sending data abroad. Food businesses answer to Loi n° 2017-048 on food safety, with its self-control, traceability and sanitary approval duties, while the new Code du Travail asks employers to assess risks and run an annual prevention plan. Exporters in the free zone regime, where the Economic Development Board of Madagascar issues the attestation, mining firms, banks, e-money issuers and outsourcing providers all meet buyers who ask for ISO certificates. The Bureau des Normes de Madagascar develops national standards, and certificates usually carry accreditation from another economy within the international arrangements, because SADCAS serves Madagascar in the absence of a national body. Sterling serves clients across Madagascar from its Johannesburg office, on-site where the work needs it and remotely otherwise, drawing on 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Madagascar
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Madagascar (13)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi n° 2014-038 du 9 janvier 2015 sur la protection des données à caractère personnel (Law No. 2014-038 on the protection of personal data) Commission Malagasy de l'Informatique et des Libertés (CMIL), the independent authority the Law creates and entrusts with supervising compliance; it holds regulatory and sanctioning powers | Applies to automated and non-automated processing carried out wholly or partly in Madagascar, and to controllers established in Madagascar or using processing means located there. It sets principles of fair, lawful processing for explicit purposes with adequate, accurate data kept no longer than needed, a list of lawful grounds including consent, a ban on processing sensitive data (racial origin, biometric, genetic, religious, trade-union, health and sex-life data) subject to listed exceptions, a duty to secure data, rules for processors, rights to be informed and to access, rectify and object, prior declaration or authorisation to the CMIL, a designated data protection delegate resident in Madagascar, and transfers abroad only to a country with similar protection or with the CMIL's authorisation. | |
| Décret n° 2023-1541 du 6 décembre 2023 on the attributions, organisation and functioning of the CMIL and the processing of personal data Commission Malagasy de l'Informatique et des Libertés (CMIL) | Details how declarations, authorisations and the register of processing work: processing is started after a receipt of declaration; sensitive data, transfers abroad and high-risk processing need the CMIL's prior authorisation; the register records the controller, processor and delegate, purposes, categories of data and recipients, transfers abroad, retention and security measures; and the CMIL keeps a list of designated delegates. It also describes inspection reports and the adversarial procedure before administrative sanctions. | |
| Loi n° 2014-006 du 17 juillet 2014 sur la lutte contre la cybercriminalité, modified by Loi n° 2016-031 du 23 août 2016 Criminal justice authorities; the Law is a criminal statute and creates no supervisory body for businesses | Context for security duties: it creates offences such as fraudulent access to an information system, introduction, deletion or modification of data, interference with the operation of a system and unlawful interception of non-public transmissions. The personal data Law sets the operating duties of organisations. | |
| Commission de Supervision Bancaire et Financière (CSBF); Banky Foiben'i Madagasikara (the central bank) issues instructions under the e-money Law Banks, e-money issuers and other regulated financial institutions | Loi n° 2020-011 sur la loi bancaire (Journal Officiel n° 3992 of 15 January 2021), whose Title V covers the regulatory and supervisory authority and the CSBF's powers; and Loi n° 2016-056 sur la monnaie électronique et les établissements de monnaie électronique (Journal Officiel n° 3782 of 23 October 2017), which requires an e-money issuer to run a system that ensures the protection, integrity, authenticity and confidentiality of data and the security of transactions. The e-money Law does not name ISO/IEC 27001, PCI DSS or SOC 2. | ISO/IEC 27001, PCI DSS, SOC 2, ISO 22301, ISO/IEC 20000-1 |
| Competent health authorities designated under the food Law, with officially designated analysis laboratories Food and animal-feed businesses: production, processing, storage, transport, distribution and catering | Loi n° 2017-048 régissant la sécurité sanitaire des denrées alimentaires et de l'alimentation animale (Journal Officiel n° 3850 of 12 November 2018). Food operators must set up a self-control system, keep traceability of food at every stage, and every production, processing, storage, packing, distribution and catering establishment must obtain a sanitary approval and/or registration from the competent authorities. The Law defines a sanitary control plan (plan de maîtrise sanitaire) as the documents describing the means an establishment uses to manage microbiological, physical, chemical and allergen hazards. The text does not name HACCP, ISO 22000 or FSSC 22000, and official analysis of food for export or the local market is reserved to laboratories officially designated by the competent authorities. | HACCP, ISO 22000, FSSC 22000, ISO/IEC 17025 |
| Ministry in charge of fisheries under the Code de la pêche et de l'aquaculture Fishery and aquaculture products | Loi n° 2018-026 portant refonte de certaines dispositions de la loi sur le Code de la Pêche et de l'Aquaculture (Journal Officiel n° 3890 of 27 May 2019), amending Loi n° 2015-053: its stated aims include the sanitary safety of fishery and aquaculture products, and selling or transporting aquaculture products without an operating, sale or transport authorisation and a sanitary certificate is an offence. | HACCP, ISO 22000, FSSC 22000 |
| Ministry of Public Health and the Agence du Médicament de Madagascar (AMM) Human medicines, medical devices and pharmaceutical manufacturing | Loi n° 2011-002 portant Code de la Santé (Journal Officiel n° 3560 of 16 June 2014): the Agence du Médicament de Madagascar, a public administrative body, is entrusted with implementing and controlling the quality of medicines; every human medicine, made locally or imported, needs a marketing authorisation issued by the Agency before sale; an application to open a manufacturing establishment must show the manufacturer will respect good manufacturing practice recognised by the State; and the Code defines a medical device. | ISO 13485, ISO/IEC 17025 |
| Bureau des Normes de Madagascar (BNM) Producers and standards users across industry | Public administrative establishment that is the national standardisation body, created by Décret n° 98-944 du 4 novembre 1998 and governed by Décret n° 2014-1570 du 30 septembre 2014; BNM states it is responsible for implementing the national standardisation strategy, and it publishes Malagasy standards through technical standardisation committees. Standards role only. | ISO 9001, ISO 14001, ISO 45001, ISO/IEC 17025 |
| Ministry in charge of labour Employers and workplaces | Loi n° 2024-014 portant Code du Travail (Journal Officiel n° 4237 of 4 November 2024): the employer must ensure the safety and health of workers in all work-related aspects, assess risks periodically and keep a single risk assessment document (DUER), prepare and carry out an annual prevention action plan (PAP), supply protective equipment, plan for emergencies and first aid, and train workers; an enterprise with fifty or more workers sets up a Safety and Health at Work Committee; every employer ensures workers are affiliated to an approved occupational medical service. | ISO 45001 |
| Mining administration under the Code minier Mining and quarrying | Loi n° 2023-007 portant refonte du Code Minier (Journal Officiel n° 4157 of 2 October 2023): a mining permit holder must respect hygiene, sanitation, public health, occupational safety and health and radiation protection rules in all mine and quarry works, and the validity of the environmental permit or environmental authorisation is one of the conditions for renewing a mining permit. | ISO 14001, ISO 45001 |
| Office National pour l'Environnement (ONE) with the Comité Technique d'Évaluation Investments with environmental impact | Décret n° 2025-080 du 28 janvier 2025 fixant les règles et procédures de l'Évaluation Environnementale et Sociale pour la Mise en Compatibilité des Investissements avec l'Environnement (MECIE), Journal Officiel n° 4274 of 14 April 2025: projects are categorised, category A projects need an environmental and social impact study and category B projects an environmental and social commitment programme, and ONE issues the environmental permit; the decree repealed the 1999 MECIE decree. | ISO 14001 |
| Autorité de Régulation de l'Électricité (ARELEC) Electricity producers, distributors and large energy users | Loi n° 2017-020 portant Code de l'Électricité à Madagascar, dated 10 April 2018 on the legislation portal, which lists it as in force: its Title VI deals with energy efficiency and storage and its Title VII with the regulatory authority, which the Law renames ARELEC. | ISO 50001 |
| Bureau Indépendant Anti-Corruption (BIANCO) and the Pôles Anti-Corruption Public and private organisations: prevention of corruption | Loi n° 2016-020 sur la lutte contre la corruption (Journal Officiel n° 3711 of 12 October 2016): its explanatory statement says it covers corruption of foreign public officials and in the private sector and introduces the criminal liability of legal persons; Loi n° 2016-021 sur les Pôles Anti-Corruption (Journal Officiel n° 3718 of 10 November 2016) sets up the specialised anti-corruption courts. | ISO 37001, ISO 37301 |
Accreditation and recognition
- Southern African Development Community Accreditation Services (SADCAS): Multi-economy accreditation body, registered in 2005 under the Botswana Companies Act, 2003 and approved by the SADC Council of Ministers in August 2007; SADCAS states that Madagascar is one of the SADC member states without a national accreditation body, serviced by SADCAS, and its Madagascar page names focal points at the Bureau des Normes de Madagascar and lists Madagascar-based testing laboratories it has accredited.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Code des Marchés Publics (Contracting authorities, with the Autorité de Régulation des Marchés Publics (ARMP) as regulator): Loi n° 2016-055 portant Code des Marchés Publics (Journal Officiel n° 3739 of 6 March 2017) says services are defined by reference to the applicable national and international standards, which must be expressly mentioned in the special specifications (CPS), and it lets contracting authorities assess bidders' environmental competence through environmental qualification certificates or an equivalent document. It does not name ISO 9001, ISO 14001 or ISO/IEC 27001, so each bidding document sets its own evidence.
Economic zones
- Free zone and free enterprise regime (Zones et Entreprises Franches): export manufacturing and processing, export services, intensive primary production for export
- Special Economic Zones (Zones Économiques Spéciales): industrial and agro-industrial activity, science and technology, tourism, finance, transport and logistics
Sterling in Madagascar
Sterling delivers in Madagascar from its Johannesburg office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Madagascar clients ask
Must a business declare its processing of personal data to the CMIL before starting?
Yes in most cases. Computerised processing by public or private bodies is declared to the Commission Malagasy de l'Informatique et des Libertés before it starts, and processing may begin once the receipt of declaration is issued. Risky processing needs prior authorisation instead. Appointing a data protection delegate relieves the declaration duty, except where authorisation is required. Check your own position with counsel or the Commission.
Can personal data be sent abroad from Madagascar?
Only on the Law's terms. A controller may transfer data to another State if its legislation gives similar protection. Otherwise the Commission may authorise the transfer where the controller offers sufficient safeguards, such as contract clauses or internal rules, or an exception applies, for example the person's clear consent. Outsourcing and cloud arrangements should be reviewed with counsel or the regulator before data leaves the country.
Does Madagascar have its own accreditation body for ISO certification?
According to SADCAS, Madagascar has no national accreditation body; SADCAS serves the country and lists Malagasy testing laboratories among its accredited organisations but no certification bodies. Management system certificates therefore tend to carry accreditation from another economy. Request the certification body's accreditation certificate, read its scope, and confirm that your buyer accepts it.
What does the Labour Code ask employers to do about workplace risk?
The employer must assess risks periodically, keep a single risk assessment document and run an annual prevention action plan, besides supplying protective equipment, planning for emergencies and training workers. An enterprise with fifty or more workers sets up a Safety and Health at Work Committee. Those duties overlap heavily with ISO 45001, though the Code does not itself require the certificate.
What does the food safety Law expect from food businesses in Madagascar?
Food operators must run a self-control system, keep traceability at every stage and hold a sanitary approval or registration from the competent authorities for their establishment. The Law describes a sanitary control plan covering microbiological, physical, chemical and allergen hazards. It does not name HACCP or ISO 22000, so the regulator and your export buyers decide what evidence they accept.
In which language are audits and documents handled in Madagascar?
Mainly French, with Malagasy used on the shop floor and in the field. Statutes appear in French, and the Labour Code lets contracts, payslips and internal rules be written in Malagasy and/or French. Settle audit language and interpreter needs with the certification body when you apply, because records and interviewees may use different languages.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi n° 2014-038 du 9 janvier 2015 sur la protection des données à caractère personnel (Law No. 2014-038 on the protection of personal data) — cnlegis.gov.mg (accessed 18 Oct 2026)
- Décret n° 2023-1541 du 6 décembre 2023 on the attributions, organisation and functioning of the CMIL and the processing of personal data — cnlegis.gov.mg (accessed 18 Oct 2026)
- Loi n° 2014-006 du 17 juillet 2014 sur la lutte contre la cybercriminalité, modified by Loi n° 2016-031 du 23 août 2016 — cnlegis.gov.mg (accessed 18 Oct 2026)
- Loi n° 2020-011 sur la loi bancaire (Journal Officiel n° 3992 of 15 January 2021), whose Title V covers the regulatory and supervisory authority and the CSBF's powers; and Loi n° 2016-056 sur la monnaie électronique et les établissements de monnaie électronique (Journal Officiel n° 3782 of 23 October 2017), which requires an e-money issuer to run a system that ensures the protection, integrity, authenticity and confidentiality of data and the security of transactions. The e-money Law does not name ISO/IEC 27001, PCI DSS or SOC 2 — cnlegis.gov.mg (accessed 18 Oct 2026)
- Loi n° 2017-048 régissant la sécurité sanitaire des denrées alimentaires et de l'alimentation animale (Journal Officiel n° 3850 of 12 November 2018). Food operators must set up a self-control system, keep traceability of food at every stage, and every production, processing, storage, packing, distribution and catering establishment must obtain a sanitary approval and/or registration from the competent authorities. The Law defines a sanitary control plan (plan de maîtrise sanitaire) as the documents describing the means an establishment uses to manage microbiological, physical, chemical and allergen hazards. The text does not name HACCP, ISO 22000 or FSSC 22000, and official analysis of food for export or the local market is reserved to laboratories officially designated by the competent authorities — cnlegis.gov.mg (accessed 18 Oct 2026)
- Loi n° 2018-026 portant refonte de certaines dispositions de la loi sur le Code de la Pêche et de l'Aquaculture (Journal Officiel n° 3890 of 27 May 2019), amending Loi n° 2015-053: its stated aims include the sanitary safety of fishery and aquaculture products, and selling or transporting aquaculture products without an operating, sale or transport authorisation and a sanitary certificate is an offence — cnlegis.gov.mg (accessed 18 Oct 2026)
- Loi n° 2011-002 portant Code de la Santé (Journal Officiel n° 3560 of 16 June 2014): the Agence du Médicament de Madagascar, a public administrative body, is entrusted with implementing and controlling the quality of medicines; every human medicine, made locally or imported, needs a marketing authorisation issued by the Agency before sale; an application to open a manufacturing establishment must show the manufacturer will respect good manufacturing practice recognised by the State; and the Code defines a medical device — cnlegis.gov.mg (accessed 18 Oct 2026)
- Public administrative establishment that is the national standardisation body, created by Décret n° 98-944 du 4 novembre 1998 and governed by Décret n° 2014-1570 du 30 septembre 2014; BNM states it is responsible for implementing the national standardisation strategy, and it publishes Malagasy standards through technical standardisation committees. Standards role only — bnm.mg (accessed 18 Oct 2026)
- Loi n° 2024-014 portant Code du Travail (Journal Officiel n° 4237 of 4 November 2024): the employer must ensure the safety and health of workers in all work-related aspects, assess risks periodically and keep a single risk assessment document (DUER), prepare and carry out an annual prevention action plan (PAP), supply protective equipment, plan for emergencies and first aid, and train workers; an enterprise with fifty or more workers sets up a Safety and Health at Work Committee; every employer ensures workers are affiliated to an approved occupational medical service — cnlegis.gov.mg (accessed 18 Oct 2026)
- Loi n° 2023-007 portant refonte du Code Minier (Journal Officiel n° 4157 of 2 October 2023): a mining permit holder must respect hygiene, sanitation, public health, occupational safety and health and radiation protection rules in all mine and quarry works, and the validity of the environmental permit or environmental authorisation is one of the conditions for renewing a mining permit — cnlegis.gov.mg (accessed 18 Oct 2026)
- Décret n° 2025-080 du 28 janvier 2025 fixant les règles et procédures de l'Évaluation Environnementale et Sociale pour la Mise en Compatibilité des Investissements avec l'Environnement (MECIE), Journal Officiel n° 4274 of 14 April 2025: projects are categorised, category A projects need an environmental and social impact study and category B projects an environmental and social commitment programme, and ONE issues the environmental permit; the decree repealed the 1999 MECIE decree — cnlegis.gov.mg (accessed 18 Oct 2026)
- Loi n° 2017-020 portant Code de l'Électricité à Madagascar, dated 10 April 2018 on the legislation portal, which lists it as in force: its Title VI deals with energy efficiency and storage and its Title VII with the regulatory authority, which the Law renames ARELEC — cnlegis.gov.mg (accessed 18 Oct 2026)
- Loi n° 2016-020 sur la lutte contre la corruption (Journal Officiel n° 3711 of 12 October 2016): its explanatory statement says it covers corruption of foreign public officials and in the private sector and introduces the criminal liability of legal persons; Loi n° 2016-021 sur les Pôles Anti-Corruption (Journal Officiel n° 3718 of 10 November 2016) sets up the specialised anti-corruption courts — cnlegis.gov.mg (accessed 18 Oct 2026)
- Southern African Development Community Accreditation Services (SADCAS) — sadcas.org (accessed 18 Oct 2026)
- Public procurement under the Code des Marchés Publics — cnlegis.gov.mg (accessed 18 Oct 2026)
- Free zone and free enterprise regime (Zones et Entreprises Franches) — cnlegis.gov.mg (accessed 18 Oct 2026)
- Special Economic Zones (Zones Économiques Spéciales) — cnlegis.gov.mg (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice