Where we work · Nepal
ISO and GRC certification consulting in Nepal
Achieve ISO and GRC certification in Nepal with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Mumbai office team
- Effivity and Academy included
Sectors that ask for certification in Nepal
Clients include
ISO and GRC certification in Nepal at a glance
Nepal's compliance picture is drawn mostly from statute rather than from sector certification schemes. The Privacy Act, 2075 (2018) is in force with the Individual Privacy Regulations, 2077; neither creates a data protection authority, so complaints go to the District Court. Food businesses answer to the Department of Food Technology and Quality Control under the Food Hygiene and Quality Act, 2081, which treats good manufacturing practice, good hygiene practice and HACCP as the food hygiene management system. Nepal Rastra Bank's Cyber Resilience Guidelines 2023 point payment institutions to the ISO/IEC 27000 series as a benchmark, and the Labour Act, 2074 asks every employer for a registered safety and health policy. The Nepal Bureau of Standards and Metrology is the national standards body and runs the NS mark. Demand comes from hydropower and construction, hotels and tourism, food processors, cement and steel makers, banks and payment firms. Certificates are issued by accredited certification bodies, never by Sterling. Sterling's Mumbai office serves clients in Nepal, bringing 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Nepal
Each page covers who needs the standard in Nepal, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Nepal (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Privacy Act, 2075 (2018) — वैयक्तिक गोपनीयता सम्बन्धी ऐन, २०७५ (Individual Privacy Act) No data protection authority is created by the Act. A concerned person may complain to the concerned District Court and seek compensation there; the Government of Nepal is plaintiff for the offences the Act lists; public bodies must protect the personal information they hold; the Government of Nepal may frame Rules. | The Act protects privacy of body, residence, property, documents, data, correspondence, character and electronic means. It requires consent when collecting personal or family data, limits use by public bodies and bodies corporate to the purpose of collection, bars disclosure of listed details (health, property and income, employment, family matters, biometrics, signature, political affiliation, business or transaction details) without consent, prohibits unauthorised access to and recording of electronic communications, sets conditions for CCTV in public places (no cameras in toilets, bathrooms or changing rooms, and visible notice), and lets people ask public bodies to correct information. The Act names no ISO standard. | |
| Individual Privacy Regulations, 2077 (वैयक्तिक गोपनीयता सम्बन्धी नियमावली, २०७७) The District Administration Office grants permission for CCTV at business premises and monitors cameras installed by government offices; no data protection authority is created | The Regulations require consent before personal information held electronically is used by another person, require electronic information to be kept confidential and secure against unauthorised access, require people to be told how their data will be used before collection and limit use to the purpose of collection. Banks and financial institutions, shopping malls, hotels, industries and similar business premises apply to the District Administration Office for permission to install CCTV, and footage is to be kept confidential and secure and not published or used commercially. | |
| Nepal Rastra Bank (NRB) Institutions licensed by Nepal Rastra Bank's Payment Systems Department | Cyber Resilience Guidelines 2023 — NRB expects licensed institutions, and the associated entities they rely on, to comply with the standards in the guidelines; the cyber resilience framework should use industry standards such as the ISO/IEC 27000 series as benchmarks; protective controls should be in line with recognised standards such as ISO standards; assurance from participants can be self-attestation or external third-party certification, and third parties can be asked for an assessment such as a certification, accreditation or external audit. NRB says it will assess compliance against each institution's own risk-based methodology. | ISO/IEC 27001 |
| Department of Food Technology and Quality Control (DFTQC), under the Ministry of Health and Food Safety Food and feed businesses | Food Hygiene and Quality Act, 2081 (published in the Nepal Gazette on 2081.01.23 (Bikram Sambat); the Act provides that it commences on the ninety-first day from authentication) — defines the food hygiene management system as good manufacturing practice, good hygiene practice and the hazard analysis and critical control point (HACCP) system together with other prescribed practices; producers, processors and packagers must adopt the food hygiene and management system and keep premises clean; food businesses need a licence; food laboratories must meet minimum criteria including good laboratory practice, method validation, calibrated equipment, traceable reports and a records system. DFTQC describes itself as the government authority responsible for implementing and enforcing food and feed laws, with inspection, laboratory testing and import and export certification roles. | HACCP |
| Nepal Bureau of Standards and Metrology (NBSM) and the Nepal Council for Standards Manufacturers of products carrying the NS mark | Nepal Standards (Certification Mark) Act 2037 and Rules 2040 — NBSM operates the NS mark product certification scheme, publishes a list of mandatory products and acts as secretariat to the Nepal Council for Standards; the product scheme is separate from management system certification. | |
| Department of Labour and Occupational Safety Employers and workplaces | Labour Act, 2074 — Chapter 12 requires employers to make and implement a safety and health policy for workers and others at the workplace and register it with the office, which monitors compliance; employers must provide a safe working environment, safe handling of chemical, physical and biological substances, information and training in a suitable language and personal protective equipment without charge; establishments with twenty or more workers form a safety and health committee. The Department publishes the labour audit report format under the Labour Rules, 2075 (Schedule 10). The Act names no ISO standard. | |
| Department of Drug Administration (DDA), under the Ministry of Health and Food Safety Medicines and health technology products | Drug Act, 2035 (amendment listed by DDA as 2082.04.14) and the Code on Good Manufacturing Practice, 2072 (second amendment 2082); DDA has issued notices calling for details of health technology products and equipment. DDA's pages do not name ISO 13485. | |
| Office of the Investment Board Large infrastructure, energy and investment projects | Public-Private Partnership and Investment Act, 2075 and its Regulations, 2077 — the Board's legal base for large investment projects; the Act as listed does not name an ISO standard. |
Accreditation and recognition
- Nepal Bureau of Standards and Metrology (NBSM): National Standards Body of Nepal and a department of the Government of Nepal under the ministry responsible for industry; secretariat to the Nepal Council for Standards; operates the NS mark scheme, laboratories and metrology services.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public Procurement Act, 2063, Public Procurement Rules (Fourteenth Amendment 2082) and standard bidding documents (Public Procurement Monitoring Office (Office of the Prime Minister and Council of Ministers)): The Office publishes standard bidding documents for national and international competitive bidding, EPC and design-and-build contracts. Qualification criteria and the evidence required, including any quality, environmental or security certificate, are set in each bidding document; read the qualification clause of the tender you are bidding on.
Economic zones
- Special economic zones under the Special Economic Zone Act, 2073: export-oriented manufacturing
Sterling in Nepal
Sterling delivers in Nepal from its Mumbai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Nepal, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Nepali clients ask
Does Nepal have a data protection law?
Yes. The Privacy Act, 2075 (2018), authenticated on 18 September 2018, covers personal data alongside privacy of body, residence, documents and correspondence, and the Individual Privacy Regulations, 2077 add rules on electronic data and CCTV. Neither text creates a data protection authority, so obligations rest on consent, purpose limits and court enforcement. Ask your counsel how they apply to your operations.
Who enforces privacy rights in Nepal?
Mainly the courts. A person whose privacy is breached may complain to the concerned District Court and seek compensation, and the Government of Nepal acts as plaintiff for the offences the Act lists. Public bodies must protect the personal information they hold. There is no separate privacy regulator, so take legal advice on how a dispute would proceed.
Which accreditation should a certification body hold for Nepal?
Look for accreditation from a body within the international mutual recognition arrangements. NBSM, the national standards body, describes no national accreditation body for certification bodies, so certificates used in Nepal usually rest on accreditation from another economy. Request the accreditation certificate and scope before you apply.
What does Nepal's food law expect from food businesses?
A working food hygiene management system. The Food Hygiene and Quality Act, 2081 defines it as good manufacturing practice, good hygiene practice and HACCP, plus other prescribed practices, and requires producers, processors and packagers to adopt it, keep premises clean and hold a food business licence. DFTQC enforces the Act, so check the current licensing rules with the Department.
Are audits in Nepal run in Nepali or English?
Either language can be agreed. Statutes, rules and government notices appear mainly in Nepali, although the Nepal Law Commission publishes English versions of many Acts, and company manuals may be in Nepali, English or both. Decide the audit language, any interpreter and the language of controlled documents with the certification body when applying, so auditors fit the site and its people.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Privacy Act, 2075 (2018) — वैयक्तिक गोपनीयता सम्बन्धी ऐन, २०७५ (Individual Privacy Act) — lawcommission.gov.np; giwmscdnone.gov.np (accessed 12 Oct 2026)
- Individual Privacy Regulations, 2077 (वैयक्तिक गोपनीयता सम्बन्धी नियमावली, २०७७) — lawcommission.gov.np (accessed 12 Oct 2026)
- Cyber Resilience Guidelines 2023 — nrb.org.np (accessed 12 Oct 2026)
- Food Hygiene and Quality Act, 2081 (published in the Nepal Gazette on 2081.01.23 (Bikram Sambat); the Act provides that it commences on the ninety-first day from authentication) — lawcommission.gov.np; dftqc.gov.np (accessed 12 Oct 2026)
- Nepal Standards (Certification Mark) Act 2037 and Rules 2040 — nbsm.gov.np (accessed 12 Oct 2026)
- Labour Act, 2074 — dolos.gov.np (accessed 12 Oct 2026)
- Drug Act, 2035 (amendment listed by DDA as 2082.04.14) and the Code on Good Manufacturing Practice, 2072 (second amendment 2082); DDA has issued notices calling for details of health technology products and equipment. DDA's pages do not name ISO 13485. — dda.gov.np (accessed 12 Oct 2026)
- Public-Private Partnership and Investment Act, 2075 and its Regulations, 2077 — ibn.gov.np (accessed 12 Oct 2026)
- Nepal Bureau of Standards and Metrology (NBSM) — nbsm.gov.np (accessed 12 Oct 2026)
- Public Procurement Act, 2063, Public Procurement Rules (Fourteenth Amendment 2082) and standard bidding documents — ppmo.gov.np (accessed 12 Oct 2026)
- Special economic zones under the Special Economic Zone Act, 2073 — seznepal.gov.np (accessed 12 Oct 2026)
Talk to a consultant
Plan your certification with the Navi Mumbai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
india@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice