Where we work · Qatar
ISO and GRC certification consulting in Qatar
Achieve ISO and GRC certification in Qatar with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Qatar
Clients include
ISO and GRC certification in Qatar at a glance
Qatar's compliance market is shaped by a cyber agency, a central bank and two free zones as much as by customers. The National Cyber Security Agency (NCSA) runs the National Information Security Compliance Framework, under which its National Cyber Governance and Assurance Affairs issues National Information Assurance (NIA) certificates after audits by accredited audit service providers. NCSA also administers Law No. (13) of 2016, the Personal Data Privacy Protection law (PDPPL), while firms inside the Qatar Financial Centre follow the QFC Data Protection Regulations 2021. Qatar Central Bank texts point financial operators to ISO 27001, PCI-DSS for card payments and, for insurers, ISO 22301. The Qatar General Organisation for Standardisation and Metrology (QGOSM) administers the Qatar Quality Mark, and the Ras Bufontas and Umm Alhoul free zones draw logistics and heavy-industry operators. Demand therefore comes from banks, insurers and payment firms, government suppliers, energy and industry, logistics, contractors, healthcare and technology providers. Accredited certification bodies issue management system certificates within the Global ACI arrangements, and the GCC Accreditation Centre (GAC) serves Qatar. Sterling, with 20+ years of experience and 8,100+ client engagements in 60+ countries, serves Qatar from its Dubai office, with Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in Qatar
Each page covers who needs the standard in Qatar, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Qatar (7)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Data Privacy Protection Law (PDPPL) National Cyber Governance and Assurance Affairs within the National Cyber Security Agency (NCSA), empowered under Amiri Decree No. (1) of 2021 as the competent department for administering and enforcing the law | NCSA's guidelines state they are written for controllers and processors who process personal data electronically, who collect or receive personal data in anticipation of processing it electronically, or who combine electronic and traditional processing. The principles NCSA lists are transparency, honesty and respect for human dignity; data minimisation; accuracy; storage limitation; integrity and confidentiality; purpose limitation; and accountability. NCSA publishes separate guidance on privacy notices, data privacy impact assessments, breach notifications, individuals' rights, privacy by design and personal data sharing. | |
| QFC Data Protection Regulations 2021 QFC Data Protection Office (described on the QFC site as an independent institution within the QFC that administers the Regulations) | Applies to firms acting as data controllers and data processors within the Qatar Financial Centre and protects individuals as data subjects. The QFC page checked does not say how the regulations relate to Law No. (13) of 2016, so which regime governs a given firm is a question for its counsel. | |
| National Cyber Security Agency (NCSA), through its National Cyber Governance and Assurance Affairs Government sector and organisations seeking a National Information Assurance (NIA) certificate | National Information Security Compliance Framework (NISCF), of which NIA Certification is one service. NCSA's 2024 procedures state that NIA certification audits are carried out by Accredited Audit Service Providers, that NCSA offers audit service accreditation to such providers, and that, under Emiri Decree No 1 of year 2021, NCSA is responsible for issuing certificates of compliance with national information security standards and policies. NCSA's assurance site refers to NIA Standard V2.1 and National Data Classification Policy V3.0. | ISO/IEC 27001 |
| Qatar Central Bank (QCB) Exchange houses, investment companies, finance houses and their brokers | Technology Risk Instructions for Financial Services Operators (2022). The text refers to QCB Law No. 13 of 2012 and, for information security, to relevant standards including ISO 27001, ISO 27005, NIST SP800-53 and, in the payment card industry, PCI-DSS. | ISO/IEC 27001, PCI DSS |
| Qatar Central Bank (QCB) Insurers, brokers and related parties in the insurance sector | Cyber Security Regulation for Insurance Sector (reference FCSG001-REG-0004, final version dated 09/05/2019). The text states the sector is required to comply, lists the ISO 27001 series among the standards considered in developing it, says business continuity policy, procedures and plans shall be formulated in line with a global standard such as ISO 22301, and refers to the Qatar National Information Assurance Policy (NIAP) v2.0. | ISO/IEC 27001, ISO 22301 |
| Qatar Central Bank (QCB) Financial institutions under QCB supervision | Data Handling and Protection Regulation. The text states it applies to all financial institutions under QCB supervision, requires personal data to be processed in compliance with Law No. (13) of 2016, and refers to the National Cyber Security Agency's National Data Classification Policy. It does not name ISO standards. | |
| Qatar General Organisation for Standardisation and Metrology (QGOSM), Ministry of Commerce and Industry Manufacturers and producers of goods sold in Qatar | Qatar Quality Mark, introduced on 23 August 2020: a badge awarded by QGOSM to indicate the existence of a quality control mechanism at the facility and to certify the conformity of the commodity with the approved standard specifications. The page does not name ISO 9001 or any other ISO standard. |
Accreditation and recognition
- Global Accreditation Bureau (GAB): Describes itself as an accreditation body in Qatar providing accreditation services to third-party conformity assessment bodies: certification bodies for GHG emissions, management system certification bodies, inspection bodies, personnel certification bodies, testing and calibration laboratories and product certification bodies; states it complies with ISO/IEC 17011.
- GCC Accreditation Centre (GAC): Regional accreditation centre; ILAC's members-by-economy list shows GAC serving Saudi Arabia, Bahrain, Kuwait, Oman, Qatar, the UAE and Yemen as a Full Member (ILAC MRA signatory); GAC's own site says it accredits calibration, testing, medical testing, inspection, product certification and management system certification bodies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Economic zones
- Ras Bufontas (Airport Free Zone): high-value, time-sensitive products, logistics and trading, emerging technologies, industrial and consumer products
- Umm Alhoul (Seaport Free Zone): chemical, oil and gas and heavy machinery, international freight forwarding, maritime operations, logistics and trading
- Qatar Financial Centre (QFC): financial solutions (banking, insurance, asset management, capital markets), business and professional services, Islamic and alternative finance, digital, AI and technology
Sterling in Qatar
Sterling delivers in Qatar from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Qatar, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Qatari clients ask
Are certification audits in Qatar conducted in Arabic or English?
Either can work. Arabic is the official language, while English is common in banks, energy firms, contractors and technology businesses, so the choice is made with the certification body when you apply and covers both the audit and your controlled documents. If a regulator, a government buyer or a client contract calls for Arabic, that requirement decides it.
Who issues a National Information Assurance (NIA) certificate in Qatar?
NCSA does, through its National Cyber Governance and Assurance Affairs, as the body responsible for certificates of compliance with national information security standards. The audit itself is done by an Accredited Audit Service Provider that NCSA has accredited. Neither a consultant nor an ordinary ISO certification body issues the NIA certificate.
Does the PDPPL apply to a firm inside the Qatar Financial Centre?
Inside the Qatar Financial Centre the working rulebook is the QFC Data Protection Regulations 2021, with the QFC Data Protection Office as administrator. The QFC's own description does not relate them to Law No. (13) of 2016, which leaves the overlap question with your counsel.
Which bodies accredit certification bodies for Qatar?
Certification bodies are accredited by accreditation bodies within the international mutual recognition arrangements now run by Global ACI (Global Accreditation Cooperation Incorporated), and ILAC lists the GCC Accreditation Centre (GAC) as serving Qatar. Whichever route is used, check that the certification body's accreditation scope covers your standard and sector before you engage it.
Which Qatar Central Bank rules mention ISO 27001 or PCI-DSS?
The Technology Risk Instructions for Financial Services Operators (2022) point to information security standards including ISO 27001 and, for payment cards, PCI-DSS. The Cyber Security Regulation for Insurance Sector lists the ISO 27001 series among the standards it considered. Check with QCB what evidence it expects from your institution.
Cities Sterling covers in Qatar
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Privacy Protection Law (PDPPL) — ncsa.gov.qa (accessed 7 Oct 2026)
- QFC Data Protection Regulations 2021 — qfc.qa (accessed 7 Oct 2026)
- National Information Security Compliance Framework (NISCF), of which NIA Certification is one service. NCSA's 2024 procedures state that NIA certification audits are carried out by Accredited Audit Service Providers, that NCSA offers audit service accreditation to such providers, and that, under Emiri Decree No 1 of year 2021, NCSA is responsible for issuing certificates of compliance with national information security standards and policies. NCSA's assurance site refers to NIA Standard V2.1 and National Data Classification Policy V3.0. — ncsa.gov.qa (accessed 7 Oct 2026)
- Technology Risk Instructions for Financial Services Operators (2022). The text refers to QCB Law No. 13 of 2012 and, for information security, to relevant standards including ISO 27001, ISO 27005, NIST SP800-53 and, in the payment card industry, PCI-DSS. — qcb.gov.qa (accessed 7 Oct 2026)
- Cyber Security Regulation for Insurance Sector (reference FCSG001-REG-0004, final version dated 09/05/2019). The text states the sector is required to comply, lists the ISO 27001 series among the standards considered in developing it, says business continuity policy, procedures and plans shall be formulated in line with a global standard such as ISO 22301, and refers to the Qatar National Information Assurance Policy (NIAP) v2.0. — qcb.gov.qa (accessed 7 Oct 2026)
- Data Handling and Protection Regulation. The text states it applies to all financial institutions under QCB supervision, requires personal data to be processed in compliance with Law No. (13) of 2016, and refers to the National Cyber Security Agency's National Data Classification Policy. It does not name ISO standards. — qcb.gov.qa (accessed 7 Oct 2026)
- Qatar Quality Mark, introduced on 23 August 2020: a badge awarded by QGOSM to indicate the existence of a quality control mechanism at the facility and to certify the conformity of the commodity with the approved standard specifications. The page does not name ISO 9001 or any other ISO standard. — moci.gov.qa (accessed 7 Oct 2026)
- Global Accreditation Bureau (GAB) — gab.qa (accessed 7 Oct 2026)
- GCC Accreditation Centre (GAC) — ilac.org; gac.org.sa (accessed 7 Oct 2026)
- Ras Bufontas (Airport Free Zone) — qfz.gov.qa (accessed 7 Oct 2026)
- Umm Alhoul (Seaport Free Zone) — qfz.gov.qa (accessed 7 Oct 2026)
- Qatar Financial Centre (QFC) — qfc.qa (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice