Where we work · Malawi
ISO and GRC certification consulting in Malawi
Achieve ISO and GRC certification in Malawi with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Johannesburg office team
- Effivity and Academy included
Sectors that ask for certification in Malawi
- Agriculture, agro-processing and food and beverage manufacturing
- Banks, mobile money and payment service providers
- Telecommunications, ICT and outsourcing service firms
- Pharmaceutical, medical device and health product importers and distributors
- Energy, fuel and utility undertakings
- Construction and engineering contractors
Clients include
ISO and GRC certification in Malawi at a glance
Data protection and sector supervision shape demand for certification in Malawi. Under the Data Protection Act, 2024 the Malawi Communications Regulatory Authority is the designated Data Protection Authority, and it also describes itself as the national focal point for cyber security. Banks follow the Guidelines on Information and Cybersecurity Risk Management for Banks, which cover governance, outsourcing, incident management and business continuity, and payment providers work under the Reserve Bank's Payment Systems Act. The Pharmacy and Medicines Regulatory Authority regulates medicines, medical devices and food supplements, the Malawi Environment Protection Authority runs environmental assessments, and the Public Procurement and Disposal of Assets Authority oversees public tenders. Agriculture is described by the Ministry of Agriculture as the mainstay of the economy, so food processing, financial services, telecoms, health products and energy drive most requests. Malawi has no national accreditation body; SADCAS serves it, and certificates come from accredited certification bodies, never from Sterling. Sterling's Johannesburg office serves clients across Malawi, on site where needed and remotely otherwise, with 8,100+ client engagements in 60+ countries and Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in Malawi
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Malawi (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Data Protection Act, 2024 (Act No. 3 of 2024) Malawi Communications Regulatory Authority (MACRA), which describes itself as the designated Data Protection Authority and runs a Data Protection department | MACRA says the Act protects the privacy and personal data of every individual and that processing includes collection, recording, storage and publication of personal data, which must have a lawful basis. Its Head of Data Protection says the Act requires institutions to adopt strong technical and cyber security measures and to appoint a data protection officer. MACRA has trained financial-sector institutions, the police and Members of Parliament on the Act, and financial-sector representatives have asked it for a phased grace period. | |
| Electronic Transactions and Cyber Security Act (Cap. 74:02), 2016 MACRA, which describes itself as the national focal point for cyber security and hosts the Malawi Computer Emergency Response Team (MwCERT) | MACRA's MwCERT head describes the Act as in effect since 2016 and as dealing with cyber offences, and the Data Protection Act, 2024 as complementing it. | |
| Malawi Communications Regulatory Authority (MACRA) Telecommunications, ICT, data protection and national cyber security | Communications Act, 2016, listed on MACRA's Acts page; MACRA also administers the Electronic Transactions and Cyber Security Act and says it is the designated Data Protection Authority and the national focal point for cyber security; in 2025 and 2026 it ran training for the financial sector, the police and Members of Parliament on the Data Protection Act, and in August 2026 issued a public notice on unlawful processing of personal data citing the Act. | ISO/IEC 27001, ISO/IEC 27701, ISO 22301 |
| Registrar of Financial Institutions, published by the Reserve Bank of Malawi (RBM) Banks: information and cyber security risk | Guidelines on Information and Cybersecurity Risk Management for Banks (October 2019), issued under section 96 of the Financial Services Act, 2010 and listed on the RBM site: board and senior management duties, a chief information security officer, IT outsourcing and cloud rules, incident management, business continuity management with business impact analysis, recovery objectives and tests, vulnerability testing and payment card security; the Guidelines name no ISO standard and refer to international best practice and standards in general terms. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1, PCI DSS, SOC 2 |
| Reserve Bank of Malawi (RBM) Payment service providers, e-money issuers and payment channels | Payment Systems Act (No. 15 of 2016) with the Payment Systems (E-Money) Regulations, 2019, the Business Licensing (Deployment and Usage of Electronic Payment Channels) Regulations, 2019, the Payment Systems Interoperability Directive 2017 and the Guidelines for Application and Authorisation of Payment Service Providers, all listed by the Bank under payment systems. | PCI DSS, ISO/IEC 27001, SOC 2 |
| Pharmacy and Medicines Regulatory Authority (PMRA) Medicines, medical devices, cosmetics, food supplements and other allied substances | PMRA Act No. 9 of 2019 — PMRA states it regulates medicines and allied substances (including cosmetics, disinfectants, food supplements, traditional medicines, medical and surgical sundries, medical devices, reagents and condoms) and pharmacy practice; its core functions include premises regulation, clinical trials oversight, quality control testing, safety monitoring and import and export permits, and its services list GMP inspection and marketing authorisation of medicines and medical devices. | ISO 13485, ISO/IEC 17025, ISO 9001 |
| Malawi Environment Protection Authority (MEPA) Facilities with environmental impacts, waste and environmental assessment | Environment Management Act No. 19 of 2017 — MEPA states it is the principal agency for protection and sustainable management of the environment and natural resources, with regulatory functions in environmental assessments, access and benefit sharing for biological resources, and waste transfer and storage. | ISO 14001 |
| Directorate of Occupational Safety and Health, Ministry of Labour Workplaces and employers | Occupational Safety, Health and Welfare Act (1997), listed by the Ministry among its laws — the Directorate states it inspects workplaces including petroleum installations, registers and examines pressure vessels and lifting equipment, investigates occupational accidents and work-related diseases and carries out industrial hygiene surveys. | ISO 45001 |
| Malawi Energy Regulatory Authority (MERA) Electricity, liquid fuels and gas undertakings | Energy Regulation Act No. 20 of 2004 — MERA licenses energy undertakings, develops and enforces performance and safety standards for energy production, transportation and distribution, promotes energy efficiency and energy savings and works with other agencies on measures to reduce environmental impact. | ISO 50001, ISO 45001, ISO 14001, ISO 22301 |
| Ministry of Agriculture Agriculture and agro-processing | The Ministry describes agriculture as the mainstay of the country's economy and organises its work through departments for crop development, animal health and livestock, extension, research, planning, land resource conservation and irrigation. | ISO 22000, HACCP, FSSC 22000 |
| Ministry of Industrialization, Business, Trade and Tourism Industry, business, trade and tourism | The Ministry states that it promotes industrial development, manufacturing and value addition, private-sector development, domestic and international trade, investment opportunities and a competitive tourism sector, and supports exporters and importers with trade information and market access. | ISO 9001, ISO 22000 |
Accreditation and recognition
- Southern African Development Community Accreditation Services (SADCAS): Multi-economy accreditation body, registered in 2005 under the Botswana Companies Act, 2003 and approved by the SADC Council of Ministers in August 2007; SADCAS names Malawi among the SADC economies without a national accreditation body that it serves.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Public Procurement and Disposal of Public Assets Act, 2025 (Act No. 7 of 2025) (Public Procurement and Disposal of Assets Authority (PPDA), which describes itself as mandated by the PPDA Act of 2025 to monitor, regulate and oversee public procurement): A bidder must be registered with the Registrar of Companies or Registrar of Business Names, be tax compliant, disclose beneficial ownership and not be debarred; entities may require documentary evidence and must say in the bidding documents what documentation proves conformity with their qualification requirements. Qualification criteria may cover professional and technical qualifications, equipment and facilities, personnel and managerial capability and past performance. Quality, safety or security certificates are therefore asked for only where a tender sets them. PPDA keeps a central supplier database, enforces a set-aside order for micro, small and medium enterprises and introduces an electronic government procurement system.
Sterling in Malawi
Sterling delivers in Malawi from its Johannesburg office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Malawi clients ask
Who regulates data protection in Malawi?
The Malawi Communications Regulatory Authority. MACRA describes itself as the designated Data Protection Authority under the Data Protection Act, 2024, and it also calls itself the national focal point for cyber security. It has trained the financial sector, the police and Members of Parliament on the Act. Check your obligations with MACRA or your counsel.
What has MACRA said the Data Protection Act requires of institutions?
MACRA's Head of Data Protection has said the Act requires institutions to adopt strong technical and cyber security measures and to appoint a data protection officer, and MACRA says processing, including collection, recording, storage and publication, needs a lawful basis. Financial-sector representatives have asked for a phased grace period, so ask MACRA what timing applies to you.
Does Malawi have a national accreditation body?
Malawi relies on SADCAS in place of a national accreditation body. SADCAS counts Malawi among the SADC economies it serves for that reason and names two focal points on its Malawi page, one in the trade ministry and one at the Malawi Bureau of Standards. Its management system recognition covers quality, environment, health and safety, and food safety, so check each certificate's accreditation mark.
Which rules set cyber security expectations for Malawian banks?
The Guidelines on Information and Cybersecurity Risk Management for Banks, issued by the Registrar of Financial Institutions under the Financial Services Act, 2010, cover board duties, a chief information security officer, outsourcing and cloud limits, incident management and business continuity. The Reserve Bank separately lists the Payment Systems Act and e-money regulations. The Guidelines name no ISO standard.
Who regulates medicines and medical devices in Malawi?
The Pharmacy and Medicines Regulatory Authority, established by the PMRA Act No. 9 of 2019. It states that it regulates medicines and allied substances, including medical devices, cosmetics and food supplements, and pharmacy practice, with services such as GMP inspection, marketing authorisation, clinical trials oversight and import and export permits. Ask PMRA which of its authorisations your product needs.
Do public tenders in Malawi require ISO certificates?
Only when a tender says so. Under the Public Procurement and Disposal of Public Assets Act, 2025 a procuring entity sets its qualification criteria, which may cover professional and technical qualifications, equipment and personnel, and must state in the bidding documents what documents prove conformity. Registration, tax compliance and beneficial ownership disclosure are the baseline. Read each tender's eligibility section.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act, 2024 (Act No. 3 of 2024) — malawi.gov.mw; macra.mw (accessed 18 Oct 2026)
- Electronic Transactions and Cyber Security Act (Cap. 74:02), 2016 — macra.mw (accessed 18 Oct 2026)
- Communications Act, 2016, listed on MACRA's Acts page; MACRA also administers the Electronic Transactions and Cyber Security Act and says it is the designated Data Protection Authority and the national focal point for cyber security; in 2025 and 2026 it ran training for the financial sector, the police and Members of Parliament on the Data Protection Act, and in August 2026 issued a public notice on unlawful processing of personal data citing the Act — macra.mw (accessed 18 Oct 2026)
- Guidelines on Information and Cybersecurity Risk Management for Banks (October 2019), issued under section 96 of the Financial Services Act, 2010 and listed on the RBM site: board and senior management duties, a chief information security officer, IT outsourcing and cloud rules, incident management, business continuity management with business impact analysis, recovery objectives and tests, vulnerability testing and payment card security; the Guidelines name no ISO standard and refer to international best practice and standards in general terms — rbm.mw (accessed 18 Oct 2026)
- Payment Systems Act (No. 15 of 2016) with the Payment Systems (E-Money) Regulations, 2019, the Business Licensing (Deployment and Usage of Electronic Payment Channels) Regulations, 2019, the Payment Systems Interoperability Directive 2017 and the Guidelines for Application and Authorisation of Payment Service Providers, all listed by the Bank under payment systems — rbm.mw (accessed 18 Oct 2026)
- PMRA Act No. 9 of 2019 — pmra.mw (accessed 18 Oct 2026)
- Environment Management Act No. 19 of 2017 — mepa.mw (accessed 18 Oct 2026)
- Occupational Safety, Health and Welfare Act (1997), listed by the Ministry among its laws — labour.gov.mw (accessed 18 Oct 2026)
- Energy Regulation Act No. 20 of 2004 — mera.mw (accessed 18 Oct 2026)
- The Ministry describes agriculture as the mainstay of the country's economy and organises its work through departments for crop development, animal health and livestock, extension, research, planning, land resource conservation and irrigation — agriculture.gov.mw (accessed 18 Oct 2026)
- The Ministry states that it promotes industrial development, manufacturing and value addition, private-sector development, domestic and international trade, investment opportunities and a competitive tourism sector, and supports exporters and importers with trade information and market access — trade.gov.mw (accessed 18 Oct 2026)
- Southern African Development Community Accreditation Services (SADCAS) — sadcas.org (accessed 18 Oct 2026)
- Public procurement under the Public Procurement and Disposal of Public Assets Act, 2025 (Act No. 7 of 2025) — ppda.mw (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice