Where we work · Rwanda
ISO and GRC certification consulting in Rwanda
Achieve ISO and GRC certification in Rwanda with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Nairobi office team
- Effivity and Academy included
Sectors that ask for certification in Rwanda
Clients include
ISO and GRC certification in Rwanda at a glance
One regulator shapes more of Rwanda's compliance agenda than any other. The National Cyber Security Authority supervises Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy through its Data Protection and Privacy Office, which registers controllers and processors and handles authorisations to move or store data outside Rwanda. The same authority publishes Minimum Cybersecurity Standards for public institutions, the financial sector and essential service providers; the financial-sector text corresponds to PCI DSS and is partly based on ISO/IEC 27001. Food producers deal with the Rwanda Food and Drugs Authority for licensing and product registration, and the Rwanda Standards Board develops national standards. Demand comes from banks and payment providers, ICT and outsourcing firms, coffee and tea exporters, food manufacturers, zone-based factories, hospitality and construction. Certificates are issued by accredited certification bodies and usually carry accreditation from another economy within the international arrangements. Sterling serves clients across Rwanda from its Nairobi office, on-site where the work needs it and remotely otherwise, drawing on 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Rwanda
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Rwanda (14)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy National Cyber Security Authority (NCSA), designated by the Law as the supervisory authority and acting through its Data Protection and Privacy Office (dpo.gov.rw); sector authorities may issue sector-specific regulations in conjunction with it | Applies to processing by controllers and processors established or resident in Rwanda and to those outside Rwanda that process the personal data of people located in Rwanda. It sets principles of lawful, fair and transparent processing, lawful grounds including consent, rights of data subjects, impact assessments for high-risk processing, designation of a data protection officer, a representative in Rwanda for outside controllers, notification of personal data breaches to the supervisory authority, security measures, and limits on sharing, transferring and storing personal data outside Rwanda. | |
| NCSA registration, authorisation and breach services National Cyber Security Authority (NCSA) — Data Protection and Privacy Office | The Office offers application forms for a data controller certificate and a data processor certificate, for authorisation to transfer personal data outside Rwanda and for authorisation to store it outside Rwanda, a breach reporting form and a complaints service. The Law lists what a registration application must describe, including the data, the purposes, the recipients, the countries to which data will be transferred and the risks with the measures against them, and it allows the supervisory authority to cancel a certificate for false information or non-compliance. | |
| Law Nº 60/2018 of 22/8/2018 on prevention and punishment of cyber crimes National Cyber Security Authority (NCSA) publishes the text; enforcement bodies as the Law provides | Context for security duties: the statute deals with cyber offences, while the personal data Law and the NCSA minimum cybersecurity standards set the operating duties of organisations. | |
| National Cyber Security Authority (NCSA); a waiver of a requirement is documented, approved by top management and communicated to the Central Bank and, where applicable, NCSA Financial sector institutions: banks, payment providers and other regulated lenders | Minimum Cybersecurity Standards for the Financial Sector, version 1.0, first release dated 28 July 2023 in its document history. NCSA states that the standard corresponds to PCI DSS and is partially based on NIST SP 800-171, ISO/IEC 27001 and ISO/IEC 27002; it recommends that a financial institution implement an information security management system and use ISO/IEC 27001 to do so, and a footnote cites ISO 22301 for a business continuity management system. | ISO/IEC 27001, PCI DSS, ISO 22301, ISO/IEC 27701 |
| National Cyber Security Authority (NCSA) Public institutions | Minimum Cybersecurity Standards for Public Institutions, version 1.0, first release dated 28 July 2023 in its document history, issued under Law No 26/2017. For a public institution whose activity is critical to the state, national security or public safety, or that processes large amounts of critical data, the standard recommends implementing and certifying an information security management system, and it directs the institution to use ISO/IEC 27001 to implement one. | ISO/IEC 27001, ISO 22301 |
| National Cyber Security Authority (NCSA) Essential service providers | Minimum Cybersecurity Standards for Essential Service Providers, version 1.0, first release dated 28 July 2023 in its document history. It requires a provider whose activity is critical to the state or public safety to implement an information security management system, and its practice text says to use ISO/IEC 27001 for that. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 |
| Rwanda Food and Drugs Authority (Rwanda FDA) Food and beverage manufacturers, importers and distributors | Law Nº 003/2018 of 09/02/2018 establishing Rwanda Food and Drugs Authority and Law No 47/2012 of 14/01/2013 relating to the regulation and inspection of food and pharmaceutical products, as listed on the authority's laws page. The authority also publishes Regulations governing processed food products (document reference FD/TRG/007, made under Article 9 of the 2018 Law; the text leaves the adoption date blank): a valid operational licence for every food business operator, inspection against licensing requirements, good manufacturing practice with a quality assurance and quality control system, and registration of pre-packaged processed food products before they are placed on the market. The text does not require HACCP or a named food safety management system standard. | HACCP, ISO 22000, FSSC 22000 |
| Rwanda Food and Drugs Authority (Rwanda FDA) Medicines, vaccines, medical devices and in-vitro diagnostics | Rwanda FDA states a mandate to protect public health through regulation of human and veterinary medicines, vaccines and other biological products, and its site lists medical devices including in-vitro diagnostics among the product categories it regulates. | ISO 13485 |
| Rwanda Standards Board (RSB) Producers and standards users across industry | Government standards body whose site lists, among its core responsibilities, disseminating information on standards and technical regulations, taking part in putting in place technical regulations relating to standards, and representing the country at regional and international standardisation organisations; it states that it has developed and published standards covering food and agriculture, engineering, service, water and environment, chemistry, chemical and consumer products. | ISO 9001, ISO 14001, ISO 45001, ISO/IEC 17025 |
| Minister in charge of labour Employers and workplaces | Law N° 66/2018 of 30/08/2018 regulating labour in Rwanda (Official Gazette Special of 06/09/2018): an employer must ensure the health, safety and welfare in the workplace of employees and of all persons who frequent the enterprise, and an enterprise establishes an Occupational Health and Safety Committee; a Ministerial Order of the minister in charge of labour determines general occupational health and safety conditions, and RwandaLII lists Ministerial Order 2 of 2022 on occupational health and safety. | ISO 45001 |
| Office of the Ombudsman (corruption prevention unit) Public and private organisations: prevention of corruption | Law N° 54/2018 of 13/08/2018 on fighting against corruption (Official Gazette Special of 20/09/2018): chapters on obligations of organs in preventing corruption and on offences and penalties, including the offence of corruption committed by companies, cooperatives, institutions and organisations with legal personality. | ISO 37001, ISO 37301 |
| Rwanda Civil Aviation Authority (RCAA) Approved aircraft maintenance organisations | Rwanda Civil Aviation Regulations Part 5, Approved Maintenance Organizations: the text requires an organisation to run a quality system with internal audits and to hold an approval certificate; it does not mention AS9100. | AS9100 |
| Rwanda Utilities Regulatory Authority (RURA) Energy, telecommunications and other utilities | RURA states a mandate to regulate electricity, renewable energy, gas and downstream petroleum, and, in telecommunications, information technology and other converging technologies, to license and monitor licence obligations. | ISO 50001, ISO/IEC 20000-1 |
| Rwanda Development Board (RDB) One Stop Center New investors and projects needing an environmental impact assessment | RDB's One Stop Center takes investment registration and environmental impact assessment applications online and lists the nature and volume of waste and its management among the information required. | ISO 14001 |
Accreditation and recognition
- Dutch Accreditation Council (RvA): Foreign accreditation body that the Rwanda Standards Board's site names for its National Quality Testing Laboratories Division, first accredited to ISO/IEC 17025 in 2018.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement through the Umucyo e-procurement system (Rwanda Public Procurement Authority (RPPA)): RPPA's FAQ tells suppliers to register on the Umucyo portal, which requires a digital certificate mapped to the supplier's user account; the registration is approved by the portal's administrator. Quality or security certificates matter only where an individual bidding document sets them.
Economic zones
- Kigali Special Economic Zone (KSEZ): manufacturing, industrial and commercial land for exporters
- Kigali International Financial Centre (KIFC): financial services, cross-border investment structuring
Sterling in Rwanda
Sterling delivers in Rwanda from its Nairobi office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Rwanda clients ask
Must organisations in Rwanda register with the National Cyber Security Authority before processing personal data?
Yes. The personal data Law requires anyone who intends to act as a data controller or data processor to register with the supervisory authority, the National Cyber Security Authority, which issues a registration certificate. The application describes the data, purposes, recipients, destination countries and risks. Outside organisations that process data of people in Rwanda are covered too; check your own position with your counsel or the Data Protection and Privacy Office.
Can personal data be stored or sent outside Rwanda?
Only on the Law's terms. Personal data is stored in Rwanda unless the controller or processor holds authorisation to store it elsewhere, and transfers abroad need authorisation from the supervisory authority with proof of safeguards, or another ground the Law lists such as the person's consent. The Office publishes forms for both authorisations. Cloud and BPO arrangements should be checked with counsel or the regulator.
Do the NCSA minimum cybersecurity standards require ISO 27001?
Not as a certificate in every case, but the texts point to it. The financial-sector standard recommends an information security management system built on ISO/IEC 27001, the public-institution standard directs institutions to use it and recommends certification for critical bodies, and the essential-service standard requires a management system for critical providers. Ask NCSA how your sector's standard applies to you.
What does Rwanda FDA expect from food manufacturers?
A valid operational licence, inspection against the licensing requirements, good manufacturing practice with quality assurance and quality control, and registration of pre-packaged processed foods before they reach the market, according to the processed food regulations published on the authority's site. The text does not name HACCP or ISO 22000. Confirm current requirements with Rwanda FDA before you plan.
Which accreditation do certificates for Rwandan organisations usually carry?
Usually accreditation from a body in another economy, working within the international mutual recognition arrangements. The Rwanda Standards Board's own site, for instance, names the Dutch Accreditation Council as the accreditor of its testing laboratories. Whatever certificate you pursue, ask the certification body for its accreditation certificate and scope, and check that your buyer or regulator accepts it.
Which language are audits in Rwanda conducted in?
Usually English or French, with Ikinyarwanda used for interviews where staff prefer it. The Constitution makes Ikinyarwanda, English and French the official languages, and the data protection office publishes in all three. Settle the audit language, any interpreter and the language of controlled documents with the certification body when you apply, so evidence is reviewed in a language the auditor reads.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy — dpo.gov.rw; cyber.gov.rw (accessed 17 Oct 2026)
- NCSA registration, authorisation and breach services — dpo.gov.rw (accessed 17 Oct 2026)
- Law Nº 60/2018 of 22/8/2018 on prevention and punishment of cyber crimes — cyber.gov.rw (accessed 17 Oct 2026)
- Minimum Cybersecurity Standards for the Financial Sector, version 1.0, first release dated 28 July 2023 in its document history. NCSA states that the standard corresponds to PCI DSS and is partially based on NIST SP 800-171, ISO/IEC 27001 and ISO/IEC 27002; it recommends that a financial institution implement an information security management system and use ISO/IEC 27001 to do so, and a footnote cites ISO 22301 for a business continuity management system — cyber.gov.rw (accessed 17 Oct 2026)
- Minimum Cybersecurity Standards for Public Institutions, version 1.0, first release dated 28 July 2023 in its document history, issued under Law No 26/2017. For a public institution whose activity is critical to the state, national security or public safety, or that processes large amounts of critical data, the standard recommends implementing and certifying an information security management system, and it directs the institution to use ISO/IEC 27001 to implement one — cyber.gov.rw (accessed 17 Oct 2026)
- Minimum Cybersecurity Standards for Essential Service Providers, version 1.0, first release dated 28 July 2023 in its document history. It requires a provider whose activity is critical to the state or public safety to implement an information security management system, and its practice text says to use ISO/IEC 27001 for that — cyber.gov.rw (accessed 17 Oct 2026)
- Law Nº 003/2018 of 09/02/2018 establishing Rwanda Food and Drugs Authority and Law No 47/2012 of 14/01/2013 relating to the regulation and inspection of food and pharmaceutical products, as listed on the authority's laws page. The authority also publishes Regulations governing processed food products (document reference FD/TRG/007, made under Article 9 of the 2018 Law; the text leaves the adoption date blank): a valid operational licence for every food business operator, inspection against licensing requirements, good manufacturing practice with a quality assurance and quality control system, and registration of pre-packaged processed food products before they are placed on the market. The text does not require HACCP or a named food safety management system standard — rwandafda.gov.rw (accessed 17 Oct 2026)
- Rwanda FDA states a mandate to protect public health through regulation of human and veterinary medicines, vaccines and other biological products, and its site lists medical devices including in-vitro diagnostics among the product categories it regulates — rwandafda.gov.rw (accessed 17 Oct 2026)
- Government standards body whose site lists, among its core responsibilities, disseminating information on standards and technical regulations, taking part in putting in place technical regulations relating to standards, and representing the country at regional and international standardisation organisations; it states that it has developed and published standards covering food and agriculture, engineering, service, water and environment, chemistry, chemical and consumer products — rsb.gov.rw (accessed 17 Oct 2026)
- Law N° 66/2018 of 30/08/2018 regulating labour in Rwanda (Official Gazette Special of 06/09/2018): an employer must ensure the health, safety and welfare in the workplace of employees and of all persons who frequent the enterprise, and an enterprise establishes an Occupational Health and Safety Committee; a Ministerial Order of the minister in charge of labour determines general occupational health and safety conditions, and RwandaLII lists Ministerial Order 2 of 2022 on occupational health and safety — minijust.gov.rw; rwandalii.org (accessed 17 Oct 2026)
- Law N° 54/2018 of 13/08/2018 on fighting against corruption (Official Gazette Special of 20/09/2018): chapters on obligations of organs in preventing corruption and on offences and penalties, including the offence of corruption committed by companies, cooperatives, institutions and organisations with legal personality — rwandalii.org; ombudsman.gov.rw (accessed 17 Oct 2026)
- Rwanda Civil Aviation Regulations Part 5, Approved Maintenance Organizations: the text requires an organisation to run a quality system with internal audits and to hold an approval certificate; it does not mention AS9100 — caa.gov.rw (accessed 17 Oct 2026)
- RURA states a mandate to regulate electricity, renewable energy, gas and downstream petroleum, and, in telecommunications, information technology and other converging technologies, to license and monitor licence obligations — rura.rw (accessed 17 Oct 2026)
- RDB's One Stop Center takes investment registration and environmental impact assessment applications online and lists the nature and volume of waste and its management among the information required — rdb.rw (accessed 17 Oct 2026)
- Dutch Accreditation Council (RvA) — rsb.gov.rw (accessed 17 Oct 2026)
- Public procurement through the Umucyo e-procurement system — rppa.gov.rw (accessed 17 Oct 2026)
- Kigali Special Economic Zone (KSEZ) — rdb.rw (accessed 17 Oct 2026)
- Kigali International Financial Centre (KIFC) — kifc.rw (accessed 17 Oct 2026)
Talk to a consultant
Plan your certification with the Nairobi team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Nairobi office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice