Where we work · Peru
ISO and GRC certification consulting in Peru
Achieve ISO and GRC certification in Peru with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- New York office team
- Effivity and Academy included
Sectors that ask for certification in Peru
- Mining suppliers, contractors and equipment makers
- Agro-export growers, packers and processors (avocados, grapes, blueberries)
- Fishing, aquaculture and fish-processing exporters
- Banks, insurers, payment firms and the technology providers that serve them
- Pharmaceutical, medical device and health-product firms
- Construction, infrastructure and industrial contractors
Clients include
In short
ISO and GRC certification in Peru at a glance
Peru has put information, privacy and integrity rules on a standards footing in recent years. A 2023 resolution tells public entities to use NTP-ISO/IEC 27001 for their security management systems, the 2024 Reglamento of the personal data law adds incident notification and a security document, and the 2025 artificial intelligence regulation points public developers to NTP-ISO/IEC 42001. INACAL accredits certification bodies through its Dirección de Acreditación and, in October 2026, urged buyers to check accreditation scope before paying for any ISO certificate. SBS rules ask banks to evidence ISO/IEC 27001 and SOC 2 reports from cloud providers, while SANIPES, SENASA and the Ministry of Health govern food safety for exporters. Mining suppliers, agro-exporters, fishing firms, banks and their technology providers, pharmaceutical firms and public suppliers drive demand. Certificates come from accredited certification bodies, never from Sterling. Sterling's New York office serves clients in Peru on-site where the work needs it and remotely otherwise, bringing 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
Explore
ISO and GRC standards Sterling delivers in Peru
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
ISO 22301Sterling guide to the standardISO 37001Sterling guide to the standardISO 37301Sterling guide to the standard
Financial services, payments & AML
Food safety & agriculture
FSSC 22000Sterling guide to the standardHACCPSterling guide to the standardISO 22000Sterling guide to the standard
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Peru (15)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Ley N° 29733, Ley de Protección de Datos Personales — Personal Data Protection Law Autoridad Nacional de Protección de Datos Personales (National Authority for Personal Data Protection), exercised by the Ministerio de Justicia y Derechos Humanos; the Reglamento names its Dirección General de Transparencia, Acceso a la Información Pública y Protección de Datos Personales as the body that exercises it. The authority runs the Registro Nacional de Protección de Datos Personales. | Applies to personal data in public and private databases processed in Peru, with exclusions for purely private or family use and certain public-security uses. Sets principles of legality, consent, purpose, proportionality, quality, security, recourse and adequate level of protection; consent is prior, informed, express and unequivocal, and written for sensitive data; owners have rights of information, access, update, rectification, deletion, objection, preventing disclosure and objective treatment; owners and processors must adopt technical, organisational and legal security measures and keep data confidential; databases are registered with the authority; cross-border flows require an adequate level of protection or other listed grounds. The authority investigates complaints and applies the law's sanctions. | |
| Decreto Supremo N° 016-2024-JUS — Reglamento de la Ley N° 29733 Autoridad Nacional de Protección de Datos Personales, through the Dirección General de Transparencia, Acceso a la Información Pública y Protección de Datos Personales of the Ministerio de Justicia y Derechos Humanos. | Requires notice to the authority of qualifying security incidents within 48 hours of becoming aware of them, unless there are grounded reasons for delay, and to inform affected people; requires a documented security document, access control with logs, privilege reviews and backups; provides for a data protection officer where processing is by a public entity, is large-scale or centres on sensitive data; recognises impact assessments and codes of conduct; and makes database registration free and automatically approved. The Ministry's own announcement says the security rules were updated with the most recent ISO standards, highlighting NTP-ISO/IEC 27001. | |
| Instituto Nacional de Calidad (INACAL), attached to the Ministerio de la Producción Standardisation, accreditation and metrology (all sectors) | INACAL's Dirección de Acreditación administers accreditation policy under Ley N° 30224 and accredits laboratories, inspection bodies, certification bodies and other conformity assessment bodies against the international ISO/IEC standards, which INACAL adopts as Normas Técnicas Peruanas (NTP). In October 2026 INACAL published guidance telling organisations to confirm that a certification body is accredited, that the accreditation scope covers the service sold, and that an ISO certificate rests on audits rather than on documents alone. | |
| Secretaría de Gobierno y Transformación Digital (SGTD), Presidencia del Consejo de Ministros Public entities — information security management | Resolución de la Secretaría de Gobierno y Transformación Digital N° 003-2023-PCM/SGTD, dated 6 September 2023 and published in El Peruano on 8 September 2023: public entities must use the Norma Técnica Peruana NTP-ISO/IEC 27001 in force for their information security management system (SGSI), with the entity's mission processes as the minimum scope. Certification to the standard is optional; certified entities report their status each year, and private organisations may use the resolution as a reference. | ISO/IEC 27001 |
| Presidencia del Consejo de Ministros through the Secretaría de Gobierno y Transformación Digital Artificial intelligence (public and private use) | Decreto Supremo N° 115-2025-PCM, signed on 8 September 2025 and published in El Peruano on 9 September 2025, approves the Reglamento of Ley N° 31814, the law that promotes the use of artificial intelligence. It uses a risk-based approach, requires impact assessments for high-risk uses, requires public entities that develop AI systems to use NTP-ISO/IEC 42001:2025 (AI management system), and has the SGTD promote international technical standards including NTP-ISO/IEC 27002:2022 and 27005:2022. | ISO/IEC 42001, ISO/IEC 27001 |
| Superintendencia de Banca, Seguros y Administradoras Privadas de Fondos de Pensiones (SBS) Banks, insurers, pension funds, card and e-money issuers — information security and cybersecurity | Resolución SBS N° 504-2021, Reglamento para la Gestión de la Seguridad de la Información y la Ciberseguridad (issued 19 February 2021, published 23 February 2021). It applies to banks, financial companies, insurers, pension fund administrators, card and electronic-money issuers and other supervised firms in regimes by size; requires an information security and cybersecurity function; requires regular reviews of the security management system; and, for cloud services, requires the firm to evidence each year that the provider keeps valid ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018 certifications and an SOC 2 Type 2 report or equivalent. | ISO/IEC 27001, SOC 2, PCI DSS |
| Superintendencia de Banca, Seguros y Administradoras Privadas de Fondos de Pensiones (SBS) Supervised financial firms — business continuity | Reglamento para la Gestión de la Continuidad del Negocio, approved by Resolución SBS N° 877-2020 and amended by Resolución SBS N° 00814-2025 (signed 4 March 2025, published 10 March 2025). The amendment strengthens operational resilience, adds rules for digital channels and sets recovery and reporting limits for payment outages. Neither text names an ISO standard. | |
| Ministerio de Justicia y Derechos Humanos (regulation) and Superintendencia del Mercado de Valores (technical report on a company's prevention model, on a prosecutor's request) Corporate integrity, anti-bribery and compliance (all sectors) | Ley N° 30424, the law on the administrative liability of legal entities, and its Reglamento, Decreto Supremo N° 002-2019-JUS. A company can adopt a prevention model with risk assessment, a prevention officer, complaint channels, training and monitoring. Under the Reglamento the SMV may consider certifications in risk management, compliance or anti-bribery management that the company has obtained from specialised entities in Peru or abroad; they are optional and only one factor. | ISO 37001, ISO 37301 |
| Ministerio de Salud through the Dirección General de Salud Ambiental (processed foods other than fishery and aquaculture products) and the Servicio Nacional de Sanidad Agraria (SENASA) for primary production and primary processing Food safety — industrially processed and primary agricultural foods | Decreto Legislativo N° 1062, Ley de Inocuidad de los Alimentos (28 June 2008). Article 14 makes the Ministry of Health's environmental health directorate the health authority for industrially processed food, and article 16 makes SENASA the national authority for the safety of agricultural foods at primary production and processing. SENASA's functions include promoting a quality assurance system based on hazard analysis and control of critical points. | HACCP, ISO 22000 |
| Organismo Nacional de Sanidad e Inocuidad en Pesca y Acuicultura (SANIPES), Ministerio de la Producción Fishery and aquaculture products — safety and export health certification | Reglamento Sectorial de Inocuidad para las Actividades Pesqueras y Acuícolas, Decreto Supremo N° 020-2022-PRODUCE, amended by Decreto Supremo N° 005-2025-PRODUCE (14 April 2025). The amended text requires processing-plant operators to apply a food-safety control system with hygiene procedures and good manufacturing practices and, where critical control points are detected, a self-control system based on HACCP. SANIPES alone issues the export health certificate for fishery products and aquaculture feed under Decreto Supremo N° 017-2020-PRODUCE. | HACCP, ISO 22000, FSSC 22000 |
| Servicio Nacional de Sanidad Agraria (SENASA), Ministerio de Desarrollo Agrario y Riego Agricultural exports — plant health and food safety | SENASA issues phytosanitary export certificates, certifies production sites and treatment or packing plants for plant products, and keeps registers of agri-food safety establishments. In September 2026 it reported that avocado exports reached 505,377 tonnes in the first half of 2026 and that Peru is the world's second exporter of avocados, with 70 open markets. | HACCP, ISO 22000 |
| Dirección General de Medicamentos, Insumos y Drogas (DIGEMID), Ministerio de Salud Pharmaceutical products, medical devices and health products | DIGEMID describes itself as the highest national authority to regulate, control and monitor all pharmaceutical products, medical devices and health products sold in Peru, with directorates for pharmaceutical products, for medical devices and health products, for inspection and certification, and for pharmacovigilance. No national text seen requires ISO 13485 by name. | |
| Superintendencia Nacional de Fiscalización Laboral (SUNAFIL), attached to the Ministerio de Trabajo y Promoción del Empleo Occupational safety and health (all sectors) | Ley N° 29783, Ley de Seguridad y Salud en el Trabajo (El Peruano, 20 August 2011). SUNAFIL describes its role as promoting, supervising and enforcing compliance with labour law and occupational safety and health rules. The law makes every employer responsible for integrating safety and health management into its activity; it does not name an ISO standard. | ISO 45001 |
| Organismo de Evaluación y Fiscalización Ambiental (OEFA), attached to the Ministerio del Ambiente Environmental compliance (all sectors) | OEFA describes itself as the governing body of the Sistema Nacional de Evaluación y Fiscalización Ambiental (SINEFA), promoting compliance with environmental obligations, monitoring and supervising directly, and keeping a public register of sanctioned environmental offenders. ISO 14001 is a voluntary system that can organise the records its supervision asks for. | |
| Ministerio de Energía y Minas, under the national energy efficiency law Energy efficiency | Ley N° 27345, Ley de Promoción del Uso Eficiente de la Energía (8 September 2000), declares the promotion of efficient energy use to be of national interest to secure supply, protect consumers and support competitiveness. It does not name ISO 50001. |
Accreditation and recognition
- Instituto Nacional de Calidad — Dirección de Acreditación (INACAL-DA): National accreditation body — INACAL's page describes the Dirección de Acreditación as the competent body for accreditation policy and management, with technical and functional autonomy and nationwide reach. It accredits testing, calibration and clinical laboratories, certification bodies for products, management systems and persons, inspection bodies, proficiency testing providers and validation and verification bodies, and publishes a directory of accredited bodies with their scopes.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under Ley N° 32069 and the Registro Nacional de Proveedores (Organismo Especializado para las Contrataciones Públicas Eficientes (OECE), attached to the Ministerio de Economía y Finanzas): OECE gives technical guidance, supervises compliance with procurement rules and the procurement process, resolves disputes in selection procedures and runs the Registro Nacional de Proveedores (RNP), under Ley N° 32069, Ley General de Contrataciones Públicas. Whether a procedure asks for a management-system certificate is set in that procedure's own bases, so read them before bidding.
Economic zones
- Zonas especiales de desarrollo (ZED) of Ilo, Matarani and Paita:
- Zona Franca and Zona Comercial de Tacna:
- ProInversión investment services (a state service, not a physical zone):
Sterling in Peru
Sterling delivers in Peru from its New York office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Peru clients ask
Who regulates personal data protection in Peru?
The Autoridad Nacional de Protección de Datos Personales, which the Ministry of Justice and Human Rights exercises through its transparency and data protection directorate. It applies Ley N° 29733, published on 3 July 2011, and runs the national register of databases. Confirm current duties and any filing with your counsel or the authority.
Which body accredits certification bodies in Peru?
INACAL, through its Dirección de Acreditación, which Global ACI lists as a full member and mutual recognition signatory. Its recognition entries include ISO 9001 from 2010, ISO 14001 and ISO 45001 from 2021, and ISO 37001 from April 2026. Other schemes appear without dates, so ask any certification body for its accreditation scope.
Are certification audits in Peru conducted in English?
Frequently, when the client is an exporter, bank or multinational, but regulation, tenders and national technical standards are written in Spanish. Ley N° 29735 also makes original languages official where they predominate. Settle the audit language, interpreter needs and the language of controlled documents with the certification body at the application stage.
Must Peruvian public entities follow ISO/IEC 27001?
Yes, though only for their own management system. A resolution of the Secretaría de Gobierno y Transformación Digital, dated 6 September 2023, obliges public bodies to apply NTP-ISO/IEC 27001, covering at least their mission processes. Certification is optional, and companies outside the public sector may treat the resolution as a model.
Do Peruvian public tenders require ISO certificates?
Whether a certificate is requested depends on the individual procedure. OECE, the procurement body, supervises the process under Ley N° 32069 and keeps the supplier register, but the bases of each call set the evidence bidders must give. Study them before paying for certification, and take advice where the wording leaves doubt.
Which Peruvian authorities oversee food safety for exports?
It depends on the product. SENASA covers agricultural foods at primary production and processing and issues phytosanitary certificates, the Ministry of Health covers industrially processed foods, and SANIPES alone issues export health certificates for fishery products and aquaculture feed. Check which authority covers your product before choosing a certification scheme.
Next step
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Ley N° 29733, Ley de Protección de Datos Personales — Personal Data Protection Law — congreso.gob.pe (accessed 18 Oct 2026)
- Decreto Supremo N° 016-2024-JUS — Reglamento de la Ley N° 29733 — congreso.gob.pe; gob.pe (accessed 18 Oct 2026)
- INACAL's Dirección de Acreditación administers accreditation policy under Ley N° 30224 and accredits laboratories, inspection bodies, certification bodies and other conformity assessment bodies against the international ISO/IEC standards, which INACAL adopts as Normas Técnicas Peruanas (NTP). In October 2026 INACAL published guidance telling organisations to confirm that a certification body is accredited, that the accreditation scope covers the service sold, and that an ISO certificate rests on audits rather than on documents alone. — inacal.gob.pe; gob.pe (accessed 18 Oct 2026)
- Resolución de la Secretaría de Gobierno y Transformación Digital N° 003-2023-PCM/SGTD, dated 6 September 2023 and published in El Peruano on 8 September 2023: public entities must use the Norma Técnica Peruana NTP-ISO/IEC 27001 in force for their information security management system (SGSI), with the entity's mission processes as the minimum scope. Certification to the standard is optional; certified entities report their status each year, and private organisations may use the resolution as a reference. — busquedas.elperuano.pe (accessed 18 Oct 2026)
- Decreto Supremo N° 115-2025-PCM, signed on 8 September 2025 and published in El Peruano on 9 September 2025, approves the Reglamento of Ley N° 31814, the law that promotes the use of artificial intelligence. It uses a risk-based approach, requires impact assessments for high-risk uses, requires public entities that develop AI systems to use NTP-ISO/IEC 42001:2025 (AI management system), and has the SGTD promote international technical standards including NTP-ISO/IEC 27002:2022 and 27005:2022. — busquedas.elperuano.pe (accessed 18 Oct 2026)
- Resolución SBS N° 504-2021, Reglamento para la Gestión de la Seguridad de la Información y la Ciberseguridad (issued 19 February 2021, published 23 February 2021). It applies to banks, financial companies, insurers, pension fund administrators, card and electronic-money issuers and other supervised firms in regimes by size; requires an information security and cybersecurity function; requires regular reviews of the security management system; and, for cloud services, requires the firm to evidence each year that the provider keeps valid ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018 certifications and an SOC 2 Type 2 report or equivalent. — busquedas.elperuano.pe (accessed 18 Oct 2026)
- Reglamento para la Gestión de la Continuidad del Negocio, approved by Resolución SBS N° 877-2020 and amended by Resolución SBS N° 00814-2025 (signed 4 March 2025, published 10 March 2025). The amendment strengthens operational resilience, adds rules for digital channels and sets recovery and reporting limits for payment outages. Neither text names an ISO standard. — busquedas.elperuano.pe (accessed 18 Oct 2026)
- Ley N° 30424, the law on the administrative liability of legal entities, and its Reglamento, Decreto Supremo N° 002-2019-JUS. A company can adopt a prevention model with risk assessment, a prevention officer, complaint channels, training and monitoring. Under the Reglamento the SMV may consider certifications in risk management, compliance or anti-bribery management that the company has obtained from specialised entities in Peru or abroad; they are optional and only one factor. — congreso.gob.pe (accessed 18 Oct 2026)
- Decreto Legislativo N° 1062, Ley de Inocuidad de los Alimentos (28 June 2008). Article 14 makes the Ministry of Health's environmental health directorate the health authority for industrially processed food, and article 16 makes SENASA the national authority for the safety of agricultural foods at primary production and processing. SENASA's functions include promoting a quality assurance system based on hazard analysis and control of critical points. — gob.pe (accessed 18 Oct 2026)
- Reglamento Sectorial de Inocuidad para las Actividades Pesqueras y Acuícolas, Decreto Supremo N° 020-2022-PRODUCE, amended by Decreto Supremo N° 005-2025-PRODUCE (14 April 2025). The amended text requires processing-plant operators to apply a food-safety control system with hygiene procedures and good manufacturing practices and, where critical control points are detected, a self-control system based on HACCP. SANIPES alone issues the export health certificate for fishery products and aquaculture feed under Decreto Supremo N° 017-2020-PRODUCE. — gob.pe (accessed 18 Oct 2026)
- SENASA issues phytosanitary export certificates, certifies production sites and treatment or packing plants for plant products, and keeps registers of agri-food safety establishments. In September 2026 it reported that avocado exports reached 505,377 tonnes in the first half of 2026 and that Peru is the world's second exporter of avocados, with 70 open markets. — gob.pe (accessed 18 Oct 2026)
- DIGEMID describes itself as the highest national authority to regulate, control and monitor all pharmaceutical products, medical devices and health products sold in Peru, with directorates for pharmaceutical products, for medical devices and health products, for inspection and certification, and for pharmacovigilance. No national text seen requires ISO 13485 by name. — gob.pe (accessed 18 Oct 2026)
- Ley N° 29783, Ley de Seguridad y Salud en el Trabajo (El Peruano, 20 August 2011). SUNAFIL describes its role as promoting, supervising and enforcing compliance with labour law and occupational safety and health rules. The law makes every employer responsible for integrating safety and health management into its activity; it does not name an ISO standard. — leyes.congreso.gob.pe; gob.pe (accessed 18 Oct 2026)
- OEFA describes itself as the governing body of the Sistema Nacional de Evaluación y Fiscalización Ambiental (SINEFA), promoting compliance with environmental obligations, monitoring and supervising directly, and keeping a public register of sanctioned environmental offenders. ISO 14001 is a voluntary system that can organise the records its supervision asks for. — gob.pe (accessed 18 Oct 2026)
- Ley N° 27345, Ley de Promoción del Uso Eficiente de la Energía (8 September 2000), declares the promotion of efficient energy use to be of national interest to secure supply, protect consumers and support competitiveness. It does not name ISO 50001. — leyes.congreso.gob.pe (accessed 18 Oct 2026)
- Instituto Nacional de Calidad — Dirección de Acreditación (INACAL-DA) — inacal.gob.pe; global-aci.org (accessed 18 Oct 2026)
- Public procurement under Ley N° 32069 and the Registro Nacional de Proveedores — gob.pe (accessed 18 Oct 2026)
- Zonas especiales de desarrollo (ZED) of Ilo, Matarani and Paita — leyes.congreso.gob.pe
- Zona Franca and Zona Comercial de Tacna — leyes.congreso.gob.pe
- ProInversión investment services (a state service, not a physical zone) — gob.pe
Talk to a consultant
Plan your certification with the New York team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice