Where we work · Mauritius
ISO and GRC certification consulting in Mauritius
Achieve ISO and GRC certification in Mauritius with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Johannesburg office team
- Effivity and Academy included
Sectors that ask for certification in Mauritius
Clients include
ISO and GRC certification in Mauritius at a glance
Mauritian buyers and regulators ask for ISO and GRC evidence for different reasons. The Data Protection Office, headed by the Data Protection Commissioner, supervises the Data Protection Act 2017, and new regulations on data protection officers come into operation on 1 January 2027. The Bank of Mauritius expects banks and payment service providers to run a cyber and technology risk framework, while the Food Regulations 2024 require a certified food safety management system, accredited by the Mauritius Accreditation Service or a recognised signatory body, for named food establishments. The Financial Crimes Commission Act 2023 requires legal persons for adequate procedures against corruption, the Occupational Safety and Health Act 2005 and the Environment Act 2024 set duties for employers and industry, and public bodies award contracts against the qualification criteria in each bidding document. Demand comes from global business and financial services, ICT and BPO, hospitality, food and agro-industry, manufacturing and healthcare. Certificates come from accredited certification bodies, never from Sterling. Sterling's Johannesburg office serves clients across Mauritius, drawing on 8,100+ client engagements in 60+ countries, 20+ years of practice, and Effivity and Sterling Academy included with every engagement.
ISO and GRC standards Sterling delivers in Mauritius
Each page covers who needs the standard in Mauritius, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Mauritius (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Data Protection Act 2017 Data Protection Office, a public office that acts with complete independence and impartiality, headed by the Data Protection Commissioner (a barrister), established by section 4 | Applies to processing of personal data wholly or partly by automated means and to other processing where the data form part of a filing system; it binds the State and applies to controllers and processors established in Mauritius and to those not established there that use equipment in Mauritius, who must nominate a representative. Subject to the exceptions in section 44, no person may act as a controller or processor unless registered with the Commissioner. Controllers must adopt policies and appropriate technical and organisational measures, designate an officer responsible for data protection compliance, keep a record of processing, carry out a data protection impact assessment for high-risk processing, and notify a personal data breach to the Commissioner without undue delay and, where feasible, not later than 72 hours after becoming aware of it. Transfers outside Mauritius need proof of appropriate safeguards provided to the Commissioner or another listed basis. Section 48 lets the Office lay down voluntary certification mechanisms, seals and marks and says a certification does not alter the controller's or processor's responsibility. The Act does not cite any ISO standard. | |
| Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026 Data Protection Office | Every controller must designate a data protection officer from its staff for the purpose of section 22(2)(e) of the Act (a lead officer where it designates more than one), communicate the officer's particulars to the Office, publish the contact details on its premises or website, give the officer resources and independence, and not penalise the officer for lawfully performing the duties. The officer is chosen on professional qualifications, including expert knowledge of Mauritian data protection law and evidence of certification from the Office's training or an approved institution. These regulations were not yet in operation on the date checked. | |
| Data Protection Office guidance, tools and registration services Data Protection Office | The Office's site lists these topics and its e-DPO system for registration; it also publishes decisions on complaints and guidelines. Use the Office's current forms and guidance for each step. | |
| Bank of Mauritius Banks, payment service providers and other institutions licensed or authorised by the Bank of Mauritius | Guideline on Cyber and Technology Risk Management (BOM/BSD 780, May 2023), effective 29 May 2023, issued under section 50 of the Bank of Mauritius Act 2004, section 100 of the Banking Act 2004 and section 17 of the National Payment Systems Act 2018. It sets minimum requirements on governance, a chief information security officer, security controls, third-party risk, business continuity, penetration testing and external independent audit, and says institutions should also consider encouraged measures and standards in international guidance such as the NIST Cybersecurity Framework, COBIT and other relevant ISO standards. It names no single ISO standard as mandatory. | |
| Bank of Mauritius Financial institutions using cloud services | Guideline on Use of Cloud Services (BOM/BSD 46, September 2022), issued under section 50 of the Bank of Mauritius Act 2004; it applies to cloud-based arrangements entered into by financial institutions and covers governance, risk identification, security controls and the Bank's supervisory rights. The Guideline on Outsourcing by Financial Institutions is also listed on the Bank's guidelines page (title verified; content not reviewed). | |
| National Cybersecurity Committee under the Cybersecurity and Cybercrime Act 2021, with the relevant regulatory body for each sector Owners of critical information infrastructure in financial services, the public service, ICT and broadcasting, energy and water supply, and transport | Cybersecurity and Cybercrime (Critical Information Infrastructure Designation) Regulations 2026 (GN No. 113 of 2026, Government Gazette No. 45 of 20 June 2026), in operation from 1 June 2026: the Committee, in consultation with the regulatory body, may designate a system as critical information infrastructure and gives public notice in the Gazette; designated owners must comply with the directions of the regulatory body. The regulations name no ISO standard. | |
| Ministry responsible for health, which makes the regulations; the Mauritius Food Standards Agency publishes the food legislation and guidance for food business operators Food business operators, including manufacturers of mayonnaise, processors of meat, milk and fish, and water bottlers | Food Act 2022 (Act No. 12 of 2022, Government Gazette No. 98 of 6 July 2022) and Food Regulations 2024 (GN No. 142 of 2024, in operation from 9 September 2024). Regulation 148 (in operation from 1 March 2025) requires a certified Food Safety Management System for establishments that manufacture mayonnaise, process meat, milk or fish where the supervising officer so designates, or bottle water, and says the certificate must be accredited by the Mauritius Accreditation Service or by an accreditation body that is a signatory to the international multilateral recognition arrangement; it must be available for inspection. Regulations on imports also refer to establishments holding such a certified system. The regulations define FSMS as a system that identifies, evaluates and controls hazards significant for food safety and name no ISO standard. | ISO 22000, FSSC 22000, HACCP |
| Ministry responsible for labour (the Act names the Permanent Secretary) All employers | Occupational Safety and Health Act 2005 (Act 28 of 2005): every employer must, so far as reasonably practicable, ensure the safety, health and welfare at work of employees; an employer of 50 or more employees must make a written safety and health policy, keep a register of arrangements and establish a Safety and Health Committee; every employer must assess risks and, where more than 5 persons are employed, record significant findings in a register. The Act does not cite ISO 45001. | |
| Minister responsible for the environment under the Environment Act 2024 Industrial enterprises, developers and laboratories whose activities affect the environment | Environment Act 2024 (Act No. 3 of 2024, proclaimed with effect from 1 August 2024): it provides for PER, EIA and SEA licences, lets the Minister make regulations on pollution control by industrial environmental audit (inventory of waste, environmental management plan, appointed officers), and provides that analysis by a laboratory other than an accredited or recognised laboratory is not admissible evidence of the properties of an environmental sample. It defines an accredited laboratory as one accredited by MAURITAS. It does not cite ISO 14001. | |
| Energy Efficiency Management Office (EEMO) Large energy consumers and other energy consumers | Energy Efficiency Act 2011 (Act 3/2011; sections 1 to 18 proclaimed from 18 November 2011 and sections 19 to 23 from 1 January 2013): the Director may direct the person responsible for an energy consumer to commission an energy audit by an energy auditor and file it with the plans to implement its recommendations; for a large energy consumer the Director may require recommendations to be implemented. The Act does not cite ISO 50001. | |
| Financial Crimes Commission (FCC) All private entities and public bodies | Financial Crimes Commission Act 2023 (Act 20/2023, proclaimed with effect from 29 March 2024): creates offences of corruption in private entities and bribery of or by foreign public officials; a legal person must ensure it has adequate procedures reasonably necessary to prevent such offences, and it is a defence for a legal person to prove, on a balance of probabilities, that it had adequate procedures in place. The Commission may issue guidelines on adequate procedures. The Act does not cite ISO 37001 or ISO 37301. |
Accreditation and recognition
- Mauritius Accreditation Service (MAURITAS): Accreditation body established under the Mauritius Accreditation Service Act (as defined in the Environment Act 2024); the Food Act 2022 and Food Regulations 2024 refer to accreditation by it for food testing laboratories and for certificates of a food safety management system, and the Environment Act 2024 refers to laboratories accredited by it.
- Mauritius Standards Bureau (MSB): National standards body established under the Mauritius Standards Bureau Act, which prepares Mauritian standards; its separate MSB certification mark for products and processes is governed by the Mauritius Standards Bureau (Certification Mark) Regulations 2026 (GN No. 46 of 2026, Government Gazette No. 27 of 18 April 2026).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public Procurement Act 2006 (Act 33 of 2006) and the Procurement Policy Office (Procurement Policy Office): The Act provides for awarding a procurement contract to the bidder with the lowest evaluated substantially responsive bid that meets the qualification criteria specified in the pre-qualification or bidding documents. Qualification criteria and the evidence required are set in each bidding document, so read the qualification clause of the tender; the Act does not make an ISO certificate a general requirement.
Economic zones
- Freeport and logistics (listed by the Economic Development Board as a key sector): freeport and logistics, trading and distribution, manufacturing
Sterling in Mauritius
Sterling delivers in Mauritius from its Johannesburg office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Mauritius, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Mauritian clients ask
Which accreditation should a certification body hold for Mauritius?
Look for accreditation by the Mauritius Accreditation Service (MAURITAS), which the Food Regulations 2024 name for food safety management system certificates, or by an accreditation body that is a signatory to the international multilateral recognition arrangement. Ask the certification body for its accreditation certificate and scope, then confirm that your customer or regulator accepts that accreditation.
Must a Mauritian organisation register with the Data Protection Office?
Generally yes. The Data Protection Act 2017 provides that, subject to its exceptions, no person may act as a controller or processor unless registered with the Commissioner, and it requires the application to describe the data, data subjects, purposes, recipients and any countries of transfer. Check whether an exception applies to you with your counsel or the Office.
Which food businesses must hold a certified food safety management system?
Regulation 148 of the Food Regulations 2024 covers establishments that manufacture mayonnaise or bottle water, and those processing meat, milk or fish that the supervising officer designates. The certificate must be accredited by MAURITAS or a signatory body to the international arrangement and be available for inspection. Confirm whether your establishment is caught with the Ministry or your counsel.
Does the Bank of Mauritius require banks to hold ISO 27001?
Not by name. The Guideline on Cyber and Technology Risk Management, effective 29 May 2023, sets minimum requirements for institutions licensed or authorised by the Bank and says they should also consider standards in international guidance, including NIST, COBIT and other relevant ISO standards. Confirm what the Bank expects of your institution with the Bank directly.
What extra duties fall on owners of critical information infrastructure?
Designation is made by the National Cybersecurity Committee, in consultation with the sector's regulatory body, and published by Gazette notice. Designated owners must comply with the regulatory body's directions under the Cybersecurity and Cybercrime Act 2021. The 2026 regulations apply to financial services, the public service, ICT and broadcasting, energy and water, and transport. Ask your regulator whether any of your systems are designated.
In what language are certification audits conducted in Mauritius?
English is the usual language of business records, standards and tenders, with French widely used alongside it, so audits normally run in English and interviews can run in French. Agree the audit language, any interpreter and the language of controlled documents with the certification body when you apply, because the body decides what it can staff.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act 2017 — dataprotection.govmu.org (accessed 11 Oct 2026)
- Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026 — dataprotection.govmu.org (accessed 11 Oct 2026)
- Data Protection Office guidance, tools and registration services — dataprotection.govmu.org (accessed 11 Oct 2026)
- Guideline on Cyber and Technology Risk Management (BOM/BSD 780, May 2023), effective 29 May 2023, issued under section 50 of the Bank of Mauritius Act 2004, section 100 of the Banking Act 2004 and section 17 of the National Payment Systems Act 2018. It sets minimum requirements on governance, a chief information security officer, security controls, third-party risk, business continuity, penetration testing and external independent audit, and says institutions should also consider encouraged measures and standards in international guidance such as the NIST Cybersecurity Framework, COBIT and other relevant ISO standards. It names no single ISO standard as mandatory. — bom.mu (accessed 11 Oct 2026)
- Guideline on Use of Cloud Services (BOM/BSD 46, September 2022), issued under section 50 of the Bank of Mauritius Act 2004; it applies to cloud-based arrangements entered into by financial institutions and covers governance, risk identification, security controls and the Bank's supervisory rights. The Guideline on Outsourcing by Financial Institutions is also listed on the Bank's guidelines page (title verified; content not reviewed). — bom.mu (accessed 11 Oct 2026)
- Cybersecurity and Cybercrime (Critical Information Infrastructure Designation) Regulations 2026 (GN No. 113 of 2026, Government Gazette No. 45 of 20 June 2026), in operation from 1 June 2026: the Committee, in consultation with the regulatory body, may designate a system as critical information infrastructure and gives public notice in the Gazette; designated owners must comply with the directions of the regulatory body. The regulations name no ISO standard. — supremecourt.govmu.org (accessed 11 Oct 2026)
- Food Act 2022 (Act No. 12 of 2022, Government Gazette No. 98 of 6 July 2022) and Food Regulations 2024 (GN No. 142 of 2024, in operation from 9 September 2024). Regulation 148 (in operation from 1 March 2025) requires a certified Food Safety Management System for establishments that manufacture mayonnaise, process meat, milk or fish where the supervising officer so designates, or bottle water, and says the certificate must be accredited by the Mauritius Accreditation Service or by an accreditation body that is a signatory to the international multilateral recognition arrangement; it must be available for inspection. Regulations on imports also refer to establishments holding such a certified system. The regulations define FSMS as a system that identifies, evaluates and controls hazards significant for food safety and name no ISO standard. — mauritiusassembly.govmu.org; health.govmu.org; mfsa.govmu.org (accessed 11 Oct 2026)
- Occupational Safety and Health Act 2005 (Act 28 of 2005): every employer must, so far as reasonably practicable, ensure the safety, health and welfare at work of employees; an employer of 50 or more employees must make a written safety and health policy, keep a register of arrangements and establish a Safety and Health Committee; every employer must assess risks and, where more than 5 persons are employed, record significant findings in a register. The Act does not cite ISO 45001. — labour.govmu.org (accessed 11 Oct 2026)
- Environment Act 2024 (Act No. 3 of 2024, proclaimed with effect from 1 August 2024): it provides for PER, EIA and SEA licences, lets the Minister make regulations on pollution control by industrial environmental audit (inventory of waste, environmental management plan, appointed officers), and provides that analysis by a laboratory other than an accredited or recognised laboratory is not admissible evidence of the properties of an environmental sample. It defines an accredited laboratory as one accredited by MAURITAS. It does not cite ISO 14001. — supremecourt.govmu.org (accessed 11 Oct 2026)
- Energy Efficiency Act 2011 (Act 3/2011; sections 1 to 18 proclaimed from 18 November 2011 and sections 19 to 23 from 1 January 2013): the Director may direct the person responsible for an energy consumer to commission an energy audit by an energy auditor and file it with the plans to implement its recommendations; for a large energy consumer the Director may require recommendations to be implemented. The Act does not cite ISO 50001. — publicutilities.govmu.org (accessed 11 Oct 2026)
- Financial Crimes Commission Act 2023 (Act 20/2023, proclaimed with effect from 29 March 2024): creates offences of corruption in private entities and bribery of or by foreign public officials; a legal person must ensure it has adequate procedures reasonably necessary to prevent such offences, and it is a defence for a legal person to prove, on a balance of probabilities, that it had adequate procedures in place. The Commission may issue guidelines on adequate procedures. The Act does not cite ISO 37001 or ISO 37301. — fcc.mu (accessed 11 Oct 2026)
- Mauritius Accreditation Service (MAURITAS) — supremecourt.govmu.org; health.govmu.org; mauritiusassembly.govmu.org (accessed 11 Oct 2026)
- Mauritius Standards Bureau (MSB) — supremecourt.govmu.org (accessed 11 Oct 2026)
- Public Procurement Act 2006 (Act 33 of 2006) and the Procurement Policy Office — ppo.govmu.org (accessed 11 Oct 2026)
- Freeport and logistics (listed by the Economic Development Board as a key sector) — edbmauritius.org (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice