Where we work · North Macedonia
ISO and GRC certification consulting in North Macedonia
Achieve ISO and GRC certification in North Macedonia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in North Macedonia
Clients include
ISO and GRC certification in North Macedonia at a glance
The Personal Data Protection Agency supervises the Law on Personal Data Protection, published in Official Gazette No. 42/2020 and amended by a law published as No. 294/2021, while a Law on the Security of Network and Information Systems, Official Gazette No. 135 of 4 July 2025, adds by-laws on risk-management measures and incident reporting under the Ministry of Digital Transformation. Food operators outside primary production must run HACCP-based procedures under the Law on Food Safety, overseen by the Food and Veterinary Agency, and the Agency for Medicines and Medical Devices keeps the register of medical devices. Certificates come from certification bodies accredited by the Institute for Accreditation of the Republic of North Macedonia (IARNM), which EA lists as an MLA signatory, or by an accreditation body abroad. Demand runs through automotive component makers, ICT and digital services, agri-food processors, textile producers, pharmaceutical and medical device makers and users of the technological industrial development zones. Sterling serves clients across North Macedonia from its Frankfurt office, on site where the work needs it and remotely otherwise, with 8,100+ client engagements in 60+ countries, 20+ years of experience, and Effivity and Sterling Academy included. Certificates never come from Sterling.
ISO and GRC standards Sterling delivers in North Macedonia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in North Macedonia (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law on Personal Data Protection (Закон за заштита на личните податоци) Personal Data Protection Agency (Агенција за заштита на личните податоци, AZLP) — an independent and autonomous state administration body responsible for monitoring the lawfulness of personal data processing in North Macedonia, with its seat in Skopje and accountable to the Parliament; it is the legal successor of the former Directorate for Personal Data Protection | Applies to processing done wholly or partly by automated means and to personal data in, or meant for, a filing system, with an exception for a person's purely personal or household activities. It applies to controllers and processors established in North Macedonia and also to those outside it whose processing relates to offering goods or services to people in North Macedonia or monitoring their behaviour there. Processing is lawful only on one of six bases: consent, a contract or pre-contract steps, a legal obligation, vital interests, a public-interest task or official authority, or legitimate interests unless overridden by the person's rights (the last basis is not open to state administration bodies performing their tasks). The law sets duties on notice and rights handling, processor contracts, records of processing, security of processing, notification of a breach to the Agency without undue delay and, where feasible, within 72 hours, impact assessments for high-risk processing, and a data protection officer for state administration bodies, for large-scale regular and systematic monitoring and for large-scale special-category data, whose contact details are published and sent to the Agency. Transfers to a third country rely on an adequacy decision of the Agency or on appropriate safeguards such as binding corporate rules, standard clauses adopted by the Agency or approved by the European Commission, an approved code or an approved certification mechanism; the transfer chapter does not apply to transfers to an EU or EEA member state, but the controller notifies the Agency of them. Certification is voluntary, is issued by the Agency or by certification bodies on criteria approved by the Agency's Director, and does not reduce the controller's responsibility. | |
| Agency forms, notifications and guidance for controllers Personal Data Protection Agency | The Agency states that it carries out supervisions and gives guidance and opinions under the Law on Personal Data Protection, and its controller pages explain the obligations controllers should meet to comply. | |
| Food and Veterinary Agency (Агенција за храна и ветеринарство, AHV) Food business operators | Law on Food Safety, published in the Official Gazette of the Republic of Macedonia No. 157/10 and later numbers and, for the latest consolidated text on the Agency's site, with the amending law in the Official Gazette of the Republic of North Macedonia No. 209/23. Food operators, except those in primary production and associated operations, must introduce, implement and maintain procedures based on the HACCP principles, show the Agency evidence of compliance as it requires, keep the procedure documents up to date and keep records. The Agency's director prescribes guidance on applying the HACCP principles, and operators may use national guides to meet their duties. | HACCP, ISO 22000, FSSC 22000 |
| Agency for Medicines and Medical Devices (Агенција за лекови и медицински средства, MALMED) Medicines and medical devices | Law on Medicines and Medical Devices (Закон за лековите и медицинските средства), Official Gazette No. 106/07 as amended, with the amendments listed on the Agency's page running to No. 267/25. The Agency keeps the register of medical devices for which a marketing authorisation has been issued and publishes a list of medical device manufacturers in the country, whose products range from dressings and dialysis components to masks and orthopaedic aids. Its pages do not name ISO 13485. | ISO 13485 |
| Ministry of Digital Transformation, with the national computer incident response centre MKD-CIRT Operators of network and information systems (essential and important entities) | Law on the Security of Network and Information Systems (Закон за безбедност на мрежни и информациски системи), Official Gazette of the Republic of North Macedonia No. 135 of 4 July 2025, as listed on the Ministry's page of laws within its competence. The Ministry lists by-laws on technical and methodological requirements for risk-management measures, on information exchange among essential and important entities and their suppliers or service providers, on reporting and handling incidents, on the methodology for essential and important entities, on cyber security officers, on a single cyber security portal, and on a team coordinating responses to large-scale incidents and crisis situations. It also publishes the National Cyber Security Strategy 2025-2028 with an action plan and a document headed minimum standards. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 |
| State Commission for Prevention of Corruption (Државна комисија за спречување на корупција, SCPC) Public integrity, lobbying and whistleblowing | Law on Prevention of Corruption and Conflict of Interests and Law on Lobbying, published on the Commission's site, together with its whistleblower pages, its registers and an integrity campaign. The laws name no ISO standard. | ISO 37001, ISO 37301 |
| Ministry of Environment and Physical Planning (with its Environment Administration) Environment | Law on Environment, which sets the rights and duties of legal and natural persons in protecting and improving the environment, with its amending laws and by-laws on the Ministry's legislation pages; the Ministry also lists laws on nature protection, noise, waste management and ambient air quality. The pages do not name ISO 14001. | ISO 14001 |
| Institute for Standardization of the Republic of North Macedonia (ISRSM), the national standardization body Standards (national standards) | ISRSM represents national interests in international, European and regional standardization organisations and, through public and private stakeholders, prepares and adopts voluntary national standards; its home page lists the national editions of ISO 9001, ISO 45001, ISO 14001, ISO/IEC 27001, ISO 37001 and ISO 50001 among its most important standards. | ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, ISO 37001, ISO 50001 |
Accreditation and recognition
- Institute for Accreditation of the Republic of North Macedonia (IARNM; Институт за акредитација на Република Северна Македонија): National accreditation body — it accredits testing and calibration laboratories (ISO/IEC 17025), inspection bodies (ISO/IEC 17020) and certification bodies for products, management systems (ISO/IEC 17021) and persons (ISO/IEC 17024), and it publishes lists of accredited bodies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Economic zones
- Technological Industrial Development Zones (TIDZ): automotive components, electronics and electrical equipment, manufacturing for export
Sterling in North Macedonia
Sterling delivers in North Macedonia from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions North Macedonia clients ask
Is there a personal data protection law in North Macedonia and who supervises it?
Yes. The Law on Personal Data Protection was published in Official Gazette No. 42/2020 and amended by a law published as No. 294/2021. The Personal Data Protection Agency supervises it as an independent state administration body seated in Skopje, and it says the law is harmonised with the EU regulation. Check how it applies to your processing with your counsel or the Agency.
Is HACCP compulsory for food businesses in North Macedonia?
The Law on Food Safety obliges food operators, other than those in primary production and associated operations, to introduce, implement and maintain procedures based on the HACCP principles, and to give the Food and Veterinary Agency evidence of compliance in the way it requires. The law does not demand a certificate, so ask your buyer whether one is wanted.
Who accredits certification bodies in North Macedonia?
IARNM, the Institute for Accreditation of the Republic of North Macedonia, accredits laboratories, inspection bodies and certification bodies, and EA's directory shows it as an EA MLA signatory whose scopes include management system certification. Ask each candidate certifier for its accreditation certificate and read the scope against your standard and sector. Customers may also accept bodies accredited abroad within the international arrangements.
What does the 2025 law on network and information systems cover?
The Ministry of Digital Transformation lists the Law on the Security of Network and Information Systems, Official Gazette No. 135 of 4 July 2025, with by-laws on risk-management measures, incident reporting, essential and important entities, cyber security officers and a single cyber security portal. Read the law and by-laws with counsel to see whether your organisation is an essential or important entity.
Do medical devices have to be registered with the national agency?
The Agency for Medicines and Medical Devices keeps the register of medical devices that hold a marketing authorisation and publishes a list of device manufacturers in the country. Its pages do not name ISO 13485, so ask the Agency what evidence it expects for your product class before planning a quality management system.
In which language will an ISO audit be run in North Macedonia?
Macedonian is the working language of the regulators, whose sites are also offered in Albanian and often English, and English is common in export and ICT businesses. The audit language, any interpreter and the language of controlled documents are agreed with the certification body when you apply, and a regulator, buyer or contract may set its own language rule.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law on Personal Data Protection (Закон за заштита на личните податоци) — azlp.mk (accessed 18 Oct 2026)
- Agency forms, notifications and guidance for controllers — azlp.mk (accessed 18 Oct 2026)
- Law on Food Safety, published in the Official Gazette of the Republic of Macedonia No. 157/10 and later numbers and, for the latest consolidated text on the Agency's site, with the amending law in the Official Gazette of the Republic of North Macedonia No. 209/23. Food operators, except those in primary production and associated operations, must introduce, implement and maintain procedures based on the HACCP principles, show the Agency evidence of compliance as it requires, keep the procedure documents up to date and keep records. The Agency's director prescribes guidance on applying the HACCP principles, and operators may use national guides to meet their duties — fva.gov.mk (accessed 18 Oct 2026)
- Law on Medicines and Medical Devices (Закон за лековите и медицинските средства), Official Gazette No. 106/07 as amended, with the amendments listed on the Agency's page running to No. 267/25. The Agency keeps the register of medical devices for which a marketing authorisation has been issued and publishes a list of medical device manufacturers in the country, whose products range from dressings and dialysis components to masks and orthopaedic aids. Its pages do not name ISO 13485 — malmed.gov.mk (accessed 18 Oct 2026)
- Law on the Security of Network and Information Systems (Закон за безбедност на мрежни и информациски системи), Official Gazette of the Republic of North Macedonia No. 135 of 4 July 2025, as listed on the Ministry's page of laws within its competence. The Ministry lists by-laws on technical and methodological requirements for risk-management measures, on information exchange among essential and important entities and their suppliers or service providers, on reporting and handling incidents, on the methodology for essential and important entities, on cyber security officers, on a single cyber security portal, and on a team coordinating responses to large-scale incidents and crisis situations. It also publishes the National Cyber Security Strategy 2025-2028 with an action plan and a document headed minimum standards — mdt.gov.mk; mkd-cirt.mk (accessed 18 Oct 2026)
- Law on Prevention of Corruption and Conflict of Interests and Law on Lobbying, published on the Commission's site, together with its whistleblower pages, its registers and an integrity campaign. The laws name no ISO standard — dksk.mk (accessed 18 Oct 2026)
- Law on Environment, which sets the rights and duties of legal and natural persons in protecting and improving the environment, with its amending laws and by-laws on the Ministry's legislation pages; the Ministry also lists laws on nature protection, noise, waste management and ambient air quality. The pages do not name ISO 14001 — moepp.gov.mk (accessed 18 Oct 2026)
- ISRSM represents national interests in international, European and regional standardization organisations and, through public and private stakeholders, prepares and adopts voluntary national standards; its home page lists the national editions of ISO 9001, ISO 45001, ISO 14001, ISO/IEC 27001, ISO 37001 and ISO 50001 among its most important standards — isrsm.gov.mk (accessed 18 Oct 2026)
- Institute for Accreditation of the Republic of North Macedonia (IARNM; Институт за акредитација на Република Северна Македонија) — iarm.gov.mk; european-accreditation.org (accessed 18 Oct 2026)
- Technological Industrial Development Zones (TIDZ) — investnorthmacedonia.gov.mk
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice