Where we work · Moldova
ISO and GRC certification consulting in Moldova
Achieve ISO and GRC certification in Moldova with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Moldova
Clients include
ISO and GRC certification in Moldova at a glance
Moldova's Law No. 195/2024 on personal data protection, which the National Centre for Personal Data Protection says has applied since 23 August 2026 and which transposes the GDPR, now frames every privacy conversation with a Moldovan customer. Cybersecurity rests on Law No. 48/2023 and the Cybersecurity Agency, while the National Bank of Moldova has told banks it will test their compliance with its revised ICT, information security and business continuity regulation. Food exporters deal with the National Food Safety Agency, medical device makers register with the Medicines and Medical Devices Agency, and certificates come from certification bodies accredited by MOLDAC, the National Accreditation Centre, or by a body in the international arrangements. Demand runs through agri-food, wire-harness and electronics makers, textile producers, ICT and outsourcing exporters, pharmaceutical firms and banks. Sterling supports Moldovan organisations through its Frankfurt office, working on site where the project needs it and remotely otherwise, and brings 8,100+ client engagements in 60+ countries and 20+ years to each project; Effivity and Sterling Academy come with every engagement. Accredited certification bodies, never Sterling, issue the certificates.
ISO and GRC standards Sterling delivers in Moldova
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Moldova (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law No. 195/2024 on personal data protection (Legea nr. 195 din 25-07-2024 privind protecția datelor cu caracter personal) National Centre for Personal Data Protection (Centrul Național pentru Protecția Datelor cu Caracter Personal, CNPDCP; 'the Centre' in the Law) — the Centre's own history page describes it as an autonomous public authority, independent of other public authorities and of natural and legal persons | Applies to organisations that process personal data of customers, staff, suppliers' contacts or users. The Law rests on seven principles (Article 5): lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Every processing needs a lawful basis under Articles 6, 9 or 10. People must be informed (Articles 12-14) and have rights of access, rectification, erasure, restriction, portability, objection and protection against solely automated decisions (Articles 15-22). Controllers keep records of processing (Article 30), bind processors by contract (Article 28), apply security measures suited to the risk (Article 32), notify the Centre of a breach without undue delay and where possible within 72 hours unless a risk is unlikely (Article 33), run an impact assessment before high-risk processing (Article 35) and appoint a data protection officer in the cases Article 37 lists. Article 44 says the transfers chapter does not apply to transfers to European Economic Area states; elsewhere a transfer needs an adequacy decision of the Centre, appropriate safeguards such as standard clauses approved by the Centre or adopted by the European Commission, binding corporate rules, an approved code of conduct or certification with binding commitments (Articles 45-47), or a listed derogation (Article 49). | |
| Cybersecurity Agency (Agenția pentru Securitate Cibernetică, ASC), which describes itself as the competent administrative authority at national level in cybersecurity Providers of services in critical sectors (cybersecurity) | Law No. 48 of 16 March 2023 on cybersecurity, with Government Decision No. 860 of 2024 on the identification of service providers, Government Decision No. 562 of 2025 on how service providers in critical sectors meet their cybersecurity obligations, and Government Decision No. 825 of 2025 on state supervision and control of those providers, all listed on the Agency's legislation page. | ISO/IEC 27001, ISO 22301 |
| National Bank of Moldova (Banca Națională a Moldovei) Banks and payment service providers | The Bank's 2026-2027 banking supervision priorities state that in 2025 it adopted a revised Regulation on minimum requirements for managing risks related to information and communication technology, information security and business continuity, and that in 2026 it will focus on banks' consistent application of it, including ICT governance, vulnerability management, cyber incident handling and dependence on ICT service providers; the same document names outsourcing risk and strict customer authentication for payment service providers. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1, PCI DSS |
| National Food Safety Agency (Agenția Națională pentru Siguranța Alimentelor, ANSA) Food business operators and exporters of food and feed | ANSA's press releases state that Government approved simplified requirements for small food producers on 15 January 2025, including an exemption from developing and implementing HACCP in favour of guides to good practice based on food safety principles, and that Moldova obtained the right to export fresh poultry meat to the European Union in April 2024 and processed poultry meat and table eggs in March 2023. | HACCP, ISO 22000, FSSC 22000 |
| Medicines and Medical Devices Agency (Agenția Medicamentului și Dispozitivelor Medicale, AMDM), an administrative authority subordinated to the Ministry of Health Medicines, pharmacies and medical devices | Law No. 102 of 9 June 2017 on medical devices, under which AMDM's Medical Devices Directorate runs registration of medical devices (a route for CE-marked devices and a notification route for devices without CE marking), keeps the State Register of medical devices, and operates vigilance and market surveillance; AMDM may evaluate or audit, on request, those who apply to register devices. | ISO 13485, iso-14971 |
| State Labour Inspectorate (Inspectoratul de Stat al Muncii) Employers (occupational safety and health) | The Inspectorate's occupational safety and health page publishes the Government Decisions that set minimum safety and health requirements, among them Decision No. 12 of 12 January 2022, Decision No. 906 of 16 December 2020 and Decision No. 151 of 7 March 2019 for the extractive industry, and its home page carries a channel for reporting workplace accidents. | ISO 45001 |
| Ministry of Environment (Ministerul Mediului) Projects and plans with environmental impact | The Ministry's impact-assessment page covers strategic environmental assessment of plans and programmes and environmental impact assessment of projects, and the Ministry also publishes integrated waste management policy. | ISO 14001 |
| National Centre for Sustainable Energy (Centrul Național pentru Energie Durabilă, CNED), a public institution working under Government Decision No. 1060 of 21 December 2023 Energy users and energy service providers | CNED lists among its legal framework Law No. 139 of 19 July 2018 on energy efficiency, Law No. 282 of 5 October 2023 on the energy performance of buildings and Government Decision No. 1064 of 27 December 2023 approving the programme for the energy efficiency obligations scheme for 2024-2026; its mandate covers the electronic register of energy evaluators and energy performance certificates. | ISO 50001 |
| National Anticorruption Centre (Centrul Național Anticorupție, CNA) Public and private organisations exposed to corruption and integrity risk | The Centre's legal framework page lists the Integrity Law No. 82 of 25 May 2017, Law No. 165 of 22 June 2023 on integrity whistleblowers, Law No. 325 of 23 December 2013 on institutional integrity assessment and Law No. 133 on declaring assets and personal interests; none of the laws on that page names an ISO standard. | ISO 37001, ISO 37301 |
| Institute for Standardisation of Moldova (ISM) — standards role only: under Law No. 20 of 4 March 2016 on national standardisation it elaborates and approves Moldovan standards and adopts European, international and other standards as Moldovan standards National standardisation | Moldovan standards carry the prefix SM, for example the SM EN ISO/IEC 17025:2018 series that MOLDAC uses as its reference for testing laboratories. |
Accreditation and recognition
- National Accreditation Centre (Centrul Național de Acreditare, MOLDAC): National accreditation body — a public institution established under Law No. 235 of 1 December 2011 on accreditation and conformity assessment activities, described on its site as the single national accreditation body.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Economic zones
- Moldova IT Park: software, IT services, business services
- Free economic zones, industrial parks and industrial platforms: manufacturing for export, electronics and wire harnesses, automotive components, food processing
Sterling in Moldova
Sterling delivers in Moldova from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Moldova clients ask
Does Moldova have a personal data protection law, and who supervises it?
Yes. Law No. 195/2024 on personal data protection has governed the field since 23 August 2026, according to the National Centre for Personal Data Protection, which supervises it. The Centre states that the Law transposes the GDPR and replaces the former Law No. 133 of 2011. Check how it applies to your processing with your counsel or the Centre.
Which body accredits certification bodies in Moldova?
MOLDAC, the National Accreditation Centre, is the single national accreditation body. Its 2025 report says it signed the EA multilateral agreement and the ILAC arrangement in 2017 and counts three accredited management-system certification bodies for that year. Companies can also use bodies accredited elsewhere within the international arrangements, so always check the accreditation scope on the certificate.
Does Moldova have a cybersecurity law that affects ISO 27001 projects?
Yes. Law No. 48 of 16 March 2023 on cybersecurity is administered by the Cybersecurity Agency, and Government decisions made under it deal with identifying service providers in critical sectors, their obligations and state supervision. The laws name no ISO certificate, but an ISMS gives structure for the duties. Ask counsel or the Agency whether you are an identified provider.
Who regulates food safety for Moldovan food exporters?
The National Food Safety Agency (ANSA). It reports that Moldova gained the right to export fresh poultry meat to the European Union in April 2024, and that simplified requirements for small producers, approved in January 2025, let them follow guides to good practice instead of developing HACCP. Larger exporters and buyers still often ask for HACCP-based certification.
In what language are audits and records handled in Moldova?
Mostly Romanian, because regulators and registers use it, although the data protection centre, the accreditation centre and the standards institute also publish Russian or English pages and export and ICT firms often work in English. Fix the audit language, interpreters and the language of controlled documents with your certification body when applying, unless a buyer or regulator specifies one.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law No. 195/2024 on personal data protection (Legea nr. 195 din 25-07-2024 privind protecția datelor cu caracter personal) — datepersonale.md (accessed 18 Oct 2026)
- Law No. 48 of 16 March 2023 on cybersecurity, with Government Decision No. 860 of 2024 on the identification of service providers, Government Decision No. 562 of 2025 on how service providers in critical sectors meet their cybersecurity obligations, and Government Decision No. 825 of 2025 on state supervision and control of those providers, all listed on the Agency's legislation page — asc.gov.md (accessed 18 Oct 2026)
- The Bank's 2026-2027 banking supervision priorities state that in 2025 it adopted a revised Regulation on minimum requirements for managing risks related to information and communication technology, information security and business continuity, and that in 2026 it will focus on banks' consistent application of it, including ICT governance, vulnerability management, cyber incident handling and dependence on ICT service providers; the same document names outsourcing risk and strict customer authentication for payment service providers — bnm.md (accessed 18 Oct 2026)
- ANSA's press releases state that Government approved simplified requirements for small food producers on 15 January 2025, including an exemption from developing and implementing HACCP in favour of guides to good practice based on food safety principles, and that Moldova obtained the right to export fresh poultry meat to the European Union in April 2024 and processed poultry meat and table eggs in March 2023 — ansa.gov.md (accessed 18 Oct 2026)
- Law No. 102 of 9 June 2017 on medical devices, under which AMDM's Medical Devices Directorate runs registration of medical devices (a route for CE-marked devices and a notification route for devices without CE marking), keeps the State Register of medical devices, and operates vigilance and market surveillance; AMDM may evaluate or audit, on request, those who apply to register devices — amdm.gov.md (accessed 18 Oct 2026)
- The Inspectorate's occupational safety and health page publishes the Government Decisions that set minimum safety and health requirements, among them Decision No. 12 of 12 January 2022, Decision No. 906 of 16 December 2020 and Decision No. 151 of 7 March 2019 for the extractive industry, and its home page carries a channel for reporting workplace accidents — ism.gov.md (accessed 18 Oct 2026)
- The Ministry's impact-assessment page covers strategic environmental assessment of plans and programmes and environmental impact assessment of projects, and the Ministry also publishes integrated waste management policy — mediu.gov.md (accessed 18 Oct 2026)
- CNED lists among its legal framework Law No. 139 of 19 July 2018 on energy efficiency, Law No. 282 of 5 October 2023 on the energy performance of buildings and Government Decision No. 1064 of 27 December 2023 approving the programme for the energy efficiency obligations scheme for 2024-2026; its mandate covers the electronic register of energy evaluators and energy performance certificates — cned.gov.md (accessed 18 Oct 2026)
- The Centre's legal framework page lists the Integrity Law No. 82 of 25 May 2017, Law No. 165 of 22 June 2023 on integrity whistleblowers, Law No. 325 of 23 December 2013 on institutional integrity assessment and Law No. 133 on declaring assets and personal interests; none of the laws on that page names an ISO standard — cna.md (accessed 18 Oct 2026)
- Moldovan standards carry the prefix SM, for example the SM EN ISO/IEC 17025:2018 series that MOLDAC uses as its reference for testing laboratories — standard.md (accessed 18 Oct 2026)
- National Accreditation Centre (Centrul Național de Acreditare, MOLDAC) — acreditare.md (accessed 18 Oct 2026)
- Moldova IT Park — itpark.md; invest.gov.md (accessed 18 Oct 2026)
- Free economic zones, industrial parks and industrial platforms — invest.gov.md (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice