Where we work · New Zealand
ISO and GRC certification consulting in New Zealand
Achieve ISO and GRC certification in New Zealand with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Sydney office team
- Effivity and Academy included
Sectors that ask for certification in New Zealand
Clients include
ISO and GRC certification in New Zealand at a glance
Certification demand in New Zealand is shaped less by one dominant statute than by exporters, regulators and public buyers. The Privacy Act 2020, overseen by the Privacy Commissioner, gained information privacy principle 3A on 1 May 2026, and the European Commission has found New Zealand adequate for personal data transferred from the EU. The Ministry for Primary Industries administers the Food Act 2014 and the Animal Products Act 1999, WorkSafe the Health and Safety at Work Act 2015, and the Reserve Bank's outsourcing policy applies to large banks. Government agencies procure under the Government Procurement Rules and a Supplier Code of Conduct that accepts certifications as evidence, while the National Cyber Security Centre supports the NZISM. Export-led sectors such as food and beverage, technology, agritech, aquaculture and manufacturing add steady demand. Management-system certificates come from certification bodies accredited by JASANZ, and IANZ accredits laboratories and inspection bodies; Sterling issues neither. Served from Sterling's Sydney office, New Zealand organisations draw on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in New Zealand
Each page covers who needs the standard in New Zealand, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in New Zealand (16)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Privacy Act 2020 and the Privacy Amendment Act 2025 — information privacy principles (IPPs) Office of the Privacy Commissioner (OPC) | The Act applies to agencies (businesses and organisations) that operate in New Zealand and collect personal information, including companies, small businesses and sole traders, charities and government departments. Thirteen principles, numbered 1 to 13 with 3A inserted after principle 3, govern collection, notification, storage and security, access, correction, accuracy, retention, use, disclosure, disclosure outside New Zealand and unique identifiers. Principle 5 asks for security safeguards that are reasonable in the circumstances. An agency must have at least one privacy officer. If a privacy breach has caused, or is likely to cause, anyone serious harm, the agency must notify the Privacy Commissioner and affected people as soon as practicable. Disclosure to a foreign person or entity is permitted only on the grounds principle 12 sets out, such as the receiver being subject to the Act, being subject to privacy laws with comparable safeguards, or the individual authorising it after being expressly informed. | |
| Codes of practice issued under the Privacy Act 2020 Office of the Privacy Commissioner (OPC) | The Commissioner may issue codes of practice that become part of the law, modify the operation of the Act and set rules for specific industries, organisations or types of personal information. The OPC states that the Biometric Processing Privacy Code 2025 came into force on 3 November 2025, with a transition period for agencies already using biometrics that ended on 3 August 2026. | |
| European Commission adequacy decision for New Zealand European Commission, with the Privacy Commissioner providing periodic update reports for ongoing monitoring | Adequacy allows the transfer of European personal data to New Zealand for processing without additional transfer safeguards, as the OPC describes it. It does not replace the Privacy Act, and an organisation that also handles the personal data of people in the EU should have its own advisers confirm the position. | |
| National Cyber Security Centre (NCSC), which works with the Director-General of the Government Communications Security Bureau (GCSB) Government agencies, telecommunications network operators and organisations that follow government security practice | New Zealand Information Security Manual (NZISM) — the government's manual on information assurance and information systems security, with baseline controls and good-practice controls for use by government agencies; and the Telecommunications (Interception Capability and Security) Act 2013 (TICSA), whose network security regulatory functions the NCSC performs. | |
| Reserve Bank of New Zealand (RBNZ) Large New Zealand-incorporated registered banks | Outsourcing policy (BS11) — a bank must keep the legal and practical ability to control and carry out outsourced functions and must be able to keep meeting time-critical obligations and provide basic banking services if a service provider fails. The policy does not name ISO/IEC 27001 or ISO 22301 on the RBNZ page. | |
| Ministry for Primary Industries (MPI) Food businesses selling food in New Zealand | Food Act 2014 — sets food safety requirements on a sliding scale: higher-risk businesses operate under a written food control plan, medium- and low-risk businesses under a national programme. MPI's Food Notice on requirements for food control plans and national programmes does not mention HACCP. | |
| Ministry for Primary Industries (MPI) Processors and exporters of animal material and products, such as meat and dairy | Animal Products Act 1999 — operators run a risk management programme (RMP) that MPI describes as based on the principles of Hazard Analysis and Critical Control Point (HACCP); recognised evaluators and verifiers check it, and Part 5 of the Act covers exports and official assurances. | HACCP |
| WorkSafe New Zealand All businesses and other undertakings with workers in New Zealand | Health and Safety at Work Act 2015 (HSWA), in effect since 4 April 2016 — businesses have the primary responsibility for the health and safety of their workers and of others affected by their work; officers must exercise due diligence. WorkSafe reports that the Health and Safety at Work Amendment Bill has passed and will bring changes into force later. | |
| Medsafe (New Zealand Medicines and Medical Devices Safety Authority) Medical device sponsors, importers and suppliers | Web Assisted Notification of Devices (WAND) database — Medsafe states that for medical devices to be legally supplied in New Zealand they must be notified to the WAND database, and sets out sponsor requirements and a risk classification of devices. The WAND page does not name ISO 13485. | |
| Financial Markets Authority (FMA), with standards issued by the External Reporting Board (XRB) Banks, insurers, managers of investment schemes, listed issuers and other large financial market participants | Financial Sector (Climate-related Disclosures and Other Matters) Amendment Act 2021 — climate reporting entities report against the Aotearoa New Zealand Climate Standards; the FMA monitors, reports and enforces. | |
| National Emergency Management Agency (NEMA) Lifeline utilities (essential infrastructure providers) | Civil Defence Emergency Management Act 2002 — a lifeline utility must ensure it is able to function to the fullest possible extent, even though this may be at a reduced level, during and after an emergency, and must give the Director of Civil Defence Emergency Management a written copy of its plan on request. NEMA states that an Emergency Management Act is intended to replace the 2002 Act and to rename lifeline utilities as essential infrastructure providers. | |
| Serious Fraud Office (SFO), with guidance from the Ministry of Justice All businesses (bribery and corruption risk) | Crimes Act 1961 and Secret Commissions Act 1910 — the SFO names both as primary sources of the offences it usually prosecutes. The Ministry of Justice guide 'Saying No to Bribery and Corruption – A Guide for New Zealand Businesses' states that an organisation can be held liable for foreign bribery by an employee if it failed to take reasonable steps to prevent the offence, and that anti-corruption procedures should be proportionate to the risks. | |
| Civil Aviation Authority of New Zealand (CAA) Aircraft maintenance organisations | Civil Aviation Rules Part 145, 'Aircraft Maintenance Organisations — Certification' — governs the certification and operation of aircraft maintenance organisations; the Director grants the certificate. Part 145 does not name ISO 9001 or AS9100. | |
| Office of the Privacy Commissioner (OPC); Ministry of Business, Innovation and Employment (MBIE) for the national AI strategy Organisations using artificial intelligence tools | The OPC's starting point is that the Privacy Act applies to everyone using AI tools in New Zealand and it recommends a privacy impact assessment before use. MBIE's AI strategy of July 2025 emphasises AI adoption and offers voluntary Responsible AI guidance for businesses. | |
| Energy Efficiency and Conservation Authority (EECA) Businesses that use significant energy | EECA's business programmes and guidance on understanding energy use, improving efficiency and planning for emissions reduction. They are support programmes rather than an energy-management certification requirement, and the EECA page does not name ISO 50001. | |
| Ministry for Primary Industries (MPI), with International Accreditation New Zealand (IANZ) operating the sector scheme Testing laboratories supporting Animal Products Act export testing | IANZ MPI Recognised Laboratory Programme — testing laboratories seeking to be a Recognised Agency under the Animal Products Act 1999 must be accredited by IANZ as meeting ISO/IEC 17025 before seeking recognition from MPI. | ISO/IEC 17025 |
Accreditation and recognition
- Joint Accreditation System of Australia and New Zealand (JASANZ): Joint accreditation body established by a treaty between the Australian and New Zealand governments in 1991; independently accredits organisations that certify, inspect, test and verify products, services, systems and people.
- International Accreditation New Zealand (IANZ): Accreditation body for testing and calibration laboratories (ISO/IEC 17025, ISO 15189), inspection bodies (ISO/IEC 17020), medical imaging services and building consent authorities; it is the provider of accreditation services for the Accreditation Council, a statutory body continuing under the Standards and Accreditation Act 2015.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Government Procurement Rules (5th edition) (New Zealand Government Procurement (NZGP), Ministry of Business, Innovation and Employment): The Rules set good practice for procurement planning, approaching the market and managing contracts, and where they say 'must' the rule is compulsory for the agencies they cover. The 5th edition came into effect on 1 December 2025. The Rules do not themselves require an ISO certificate; each agency sets its supplier criteria in the tender documents.
- Supplier Code of Conduct (New Zealand Government Procurement (NZGP)): The code sets expectations for suppliers of goods and services to government. NZGP says suppliers can demonstrate they are meeting the expectations with a range of evidence, including policies, practices, certifications and accreditations, and agencies may ask for evidence of compliance. Each agency decides how it enforces the code.
- GETS (Government Electronic Tenders Service) (New Zealand Government Procurement (NZGP)): The service where government contract opportunities are published and can be viewed and responded to; each tender sets its own requirements.
Economic zones
- Food and beverage: food and beverage
- Technology: technology, digital services
- Renewable energy and cleantech: renewable energy, cleantech
- Agritech and aquaculture: agritech, aquaculture
- Space and advanced transportation: space, advanced transportation
- Manufacturing: manufacturing
Sterling in New Zealand
Sterling delivers in New Zealand from its Sydney office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in New Zealand, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions New Zealand clients ask
Are certification audits in New Zealand conducted in English?
Usually yes, because English is the common language of business, but the language is agreed with the certification body at application. Māori and New Zealand Sign Language are the official languages, so say early if staff or records work in another language. Follow any language set in a tender, a regulator's correspondence or a customer contract.
Which accreditation body should a New Zealand certification body hold?
For management-system certification, look for accreditation by JASANZ, the joint Australia–New Zealand body created by treaty. JASANZ says it is a member of Global ACI and a signatory to its Mutual Recognition Arrangement. Accreditation is scope-specific, so confirm on the JASANZ directory that the body is accredited for your standard and sector before you appoint it.
Who accredits laboratories and inspection bodies in New Zealand?
International Accreditation New Zealand (IANZ) accredits testing and calibration laboratories, inspection bodies, medical imaging services and building consent authorities. It states that it is an ILAC and APAC Mutual Recognition Arrangement signatory. IANZ does not accredit management-system certification bodies, which is the role of JASANZ, so match the body to the kind of assessment you need.
Who enforces the Privacy Act 2020 and what must a business do after a serious breach?
The Office of the Privacy Commissioner oversees the Act. If a breach has caused, or is likely to cause, anyone serious harm, the business must notify the Commissioner and the affected people as soon as practicable. Every agency also needs at least one privacy officer. Confirm how this applies to your organisation with your counsel or the Commissioner's office.
Does New Zealand have EU data protection adequacy?
The OPC states that the European Commission has determined New Zealand provides an adequate level of protection for personal data transferred from the EU, and the Commissioner supplies periodic reports for ongoing monitoring. Adequacy eases transfers into New Zealand but does not replace the Privacy Act, so check your own duties with advisers if you also serve people in Europe.
How do public holidays affect audit scheduling in New Zealand?
Plan around the national holidays, including Waitangi Day and Matariki, and your region's own anniversary day, because staff and auditors are unavailable on them. Employment New Zealand publishes the observed dates each year and advises checking with the local council for regional ones. Tell the certification body your site calendar when you book, rather than assuming a standard date.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Privacy Act 2020 and the Privacy Amendment Act 2025 — information privacy principles (IPPs) — privacy.org.nz (accessed 8 Oct 2026)
- Codes of practice issued under the Privacy Act 2020 — privacy.org.nz (accessed 8 Oct 2026)
- European Commission adequacy decision for New Zealand — privacy.org.nz (accessed 8 Oct 2026)
- New Zealand Information Security Manual (NZISM) — ncsc.govt.nz (accessed 8 Oct 2026)
- Outsourcing policy (BS11) — rbnz.govt.nz (accessed 8 Oct 2026)
- Food Act 2014 — mpi.govt.nz (accessed 8 Oct 2026)
- Animal Products Act 1999 — mpi.govt.nz (accessed 8 Oct 2026)
- Health and Safety at Work Act 2015 (HSWA), in effect since 4 April 2016 — worksafe.govt.nz (accessed 8 Oct 2026)
- Web Assisted Notification of Devices (WAND) database — medsafe.govt.nz (accessed 8 Oct 2026)
- Financial Sector (Climate-related Disclosures and Other Matters) Amendment Act 2021 — environment.govt.nz (accessed 8 Oct 2026)
- Civil Defence Emergency Management Act 2002 — civildefence.govt.nz (accessed 8 Oct 2026)
- Crimes Act 1961 and Secret Commissions Act 1910 — sfo.govt.nz; justice.govt.nz (accessed 8 Oct 2026)
- Civil Aviation Rules Part 145, 'Aircraft Maintenance Organisations — caa.govt.nz (accessed 8 Oct 2026)
- The OPC's starting point is that the Privacy Act applies to everyone using AI tools in New Zealand and it recommends a privacy impact assessment before use. MBIE's AI strategy of July 2025 emphasises AI adoption and offers voluntary Responsible AI guidance for businesses. — privacy.org.nz; mbie.govt.nz (accessed 8 Oct 2026)
- EECA's business programmes and guidance on understanding energy use, improving efficiency and planning for emissions reduction. They are support programmes rather than an energy-management certification requirement, and the EECA page does not name ISO 50001. — eeca.govt.nz (accessed 8 Oct 2026)
- IANZ MPI Recognised Laboratory Programme — ianz.govt.nz (accessed 8 Oct 2026)
- Joint Accreditation System of Australia and New Zealand (JASANZ) — jasanz.org (accessed 8 Oct 2026)
- International Accreditation New Zealand (IANZ) — ianz.govt.nz (accessed 8 Oct 2026)
- Government Procurement Rules (5th edition) — procurement.govt.nz (accessed 8 Oct 2026)
- Supplier Code of Conduct — procurement.govt.nz (accessed 8 Oct 2026)
- GETS (Government Electronic Tenders Service) — procurement.govt.nz (accessed 8 Oct 2026)
- Food and beverage — nzte.govt.nz (accessed 8 Oct 2026)
- Technology — nzte.govt.nz (accessed 8 Oct 2026)
- Renewable energy and cleantech — nzte.govt.nz (accessed 8 Oct 2026)
- Agritech and aquaculture — nzte.govt.nz (accessed 8 Oct 2026)
- Space and advanced transportation — nzte.govt.nz (accessed 8 Oct 2026)
- Manufacturing — nzte.govt.nz (accessed 8 Oct 2026)
Talk to a consultant
Plan your certification with the Sydney team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
australia@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice