Where we work · Sao Tome and Principe
ISO and GRC certification consulting in Sao Tome and Principe
Achieve ISO and GRC certification in Sao Tome and Principe with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Johannesburg office team
- Effivity and Academy included
Sectors that ask for certification in Sao Tome and Principe
Clients include
ISO and GRC certification in Sao Tome and Principe at a glance
Banking and tourism publish the clearest rules in São Tomé and Príncipe. The Banco Central de São Tomé e Príncipe holds exclusive power to regulate, license and supervise financial institutions under Lei n.º 03/2025, and Decreto n.º 16/2021 obliges public bodies and commercial establishments to offer dobra24 card terminals, so information security and payment controls matter to banks, insurers and payment providers. Hotels and tour operators answer to the Direção Geral de Turismo e Hotelaria, which licenses and inspects them. The government's investment page points to hotels and resorts, fish processing, port and airport works, organic cocoa, coffee, pepper and vanilla, bottled water and mini-hydro. None of these pages names an ISO standard, so certification is driven by export buyers, lenders and international customers. Portuguese is the language of the Diário da República, and no national accreditation body is listed with the international arrangement, so certificates usually come from accredited bodies elsewhere. Sterling, with 8,100+ client engagements in 60+ countries, serves clients from its Johannesburg office, with Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in Sao Tome and Principe
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Sao Tome and Principe (6)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Lei n.º 3/2016 de Protecção de Dados Pessoais — Personal Data Protection Law Agência Nacional de Protecção de Dados Pessoais (ANPDP). The Assembleia Nacional's records describe it as the national body that supervises compliance, issues opinions, authorises or registers processing and fixes retention periods, with binding decisions open to appeal to the Tribunal Central Administrativo; the Assembly's notice of 26 January records a talk by the Agency to deputies and parliamentary staff. Its organisation law was before the Assembly as Projecto de Lei n.º 7/X/5.ª/2016. | Applies to processing within the activities of a controller established in São Tomé e Príncipe. Consent of the data subject and narrowly defined necessity are the basic conditions for processing, sensitive data have stricter rules, transfers of personal data outside the national territory are conditional on the protection guaranteed by this legal order, and those who fail to protect personal data face the sanctions in the law. | |
| Banco Central de São Tomé e Príncipe (BCSTP) Banks, insurers, exchange bureaux, microfinance and payment institutions | Lei n.º 03/2025, Lei Orgânica do Banco Central de São Tomé e Príncipe, published in the Diário da República, I Série, n.º 28, of 5 June 2025 after approval by the Assembleia Nacional on 20 March 2025 and promulgation on 22 May 2025; it repeals Lei n.º 08/92 of 3 August. The Law gives the Banco Central exclusive power to regulate, license, register and supervise financial institutions, including corrective measures and administrative sanctions. It also has the Bank regulate and oversee payment systems, supervise entities dealing in gold and foreign currency, protect financial consumers and act as resolution authority. The Bank's own supervision pages list banks, insurance companies, exchange bureaux, microfinance institutions, payment service providers and payment system operators. The Law does not name ISO or other management-system standards. | |
| Banco Central de São Tomé e Príncipe, under the national payments framework Payment cards and point-of-sale terminals | Decreto n.º 16/2021, published in the Diário da República, I Série, n.º 93, of 2 December 2021 and listed on the Banco Central's legislation page. It applies to public and private service providers and commercial establishments operating in the national territory and obliges them to install and offer point-of-sale terminals of the dobra24 card network, bought through their bank. Customer use of the terminal is optional. Its preamble places the Decree within Lei n.º 17/2018 of 7 September (the legal regime of the national payment system) and Decreto-Lei n.º 16/2019 (the regime for payment service providers and payment system operators). It does not mention PCI DSS or ISO standards. | |
| Direção Geral de Turismo e Hotelaria (DGTH), under the Ministry of Environment, Youth and Sustainable Tourism Hotels, guest houses, tour operators and other tourism businesses | The tourism ministry's site describes the DGTH's qualification department as the service that handles licensing of tourist operators, and its inspection and tourist-games directorate as the service that inspects all activities and companies in the tourism sector. The same site states that licensed tourist accommodation must display its operating licence and points visitors to a website for checking whether an establishment is licensed. It names no management-system standard. | |
| Government of the Autonomous Region of Príncipe, through its Secretaria Regional da Biosfera, Ambiente, Agricultura e Desenvolvimento Rural and its Secretaria Regional do Turismo, Economia e da Cultura Environment, biosphere and agriculture in the autonomous region of Príncipe | The Regional Government's site lists these regional secretariats together with its Lei Orgânica and its Estatuto Político e Administrativo. The tourism site records that Príncipe has been an autonomous region, formed by the district of Pagué, since 29 April 1995. The pages set out the regional structure and do not name a management-system standard. | |
| Government of São Tomé and Príncipe, through the investment opportunities page of the national tourism site Investment promotion and priority sectors | The page presents opportunities in tourism (sun and sea, hotels and resorts, nature and eco-tourism, converting the old plantation estates), fisheries (semi-industrial fishing, fish processing, shellfish and seafood export), infrastructure (a deep-water port, airport works, civil construction, naval repair and maintenance, bunkering), agriculture (organic cocoa, Robusta and Arabica coffee, organic pepper and vanilla, with special tax benefits for agricultural investment) and other activities (bottled water, tropical fruit and vegetable processing, mini-hydro). It also states that the country offers specific tax benefits for tourism. It names no certification standard. |
Accreditation and recognition
- No national accreditation body for management-system certification found: No São Tomé and Príncipe body appears in the member list of the accreditation cooperation's multilateral recognition arrangement dated 31 December 2025.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Regulamento de Licitações e Contratações Públicas (Lei n.º 8/2009 de 26 de Agosto) and the Government's proposed Lei sobre os Contratos Públicos (Proposta de Lei n.º 23/XII/3.ª/2023) (The Government office previously designated COSSIL, which the proposed law would make the Autoridade Reguladora dos Contratos Públicos (ARCOP) under the ministry responsible for finance): The Government's explanatory note to the Assembleia Nacional (Diário, II Série, n.º 42, 28 February 2024) names Lei n.º 8/2009 as the regime in place and proposes a new Lei sobre os Contratos Públicos with ARCOP as national authority for coordination, supervision and regulation, a Portal dos Contratos Públicos and electronic procurement platforms, and a mediation commission for disputes. The Assembly record shows the proposal as submitted; confirm with the ministry responsible for finance whether it has been enacted. Qualification criteria and the evidence required are set in each tender document, so read the qualification clause of the tender you are bidding on.
Sterling in Sao Tome and Principe
Sterling delivers in Sao Tome and Principe from its Johannesburg office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Sao Tome and Principe clients ask
Who supervises banks, insurers and payment providers in São Tomé and Príncipe?
The Banco Central de São Tomé e Príncipe. Under Lei n.º 03/2025, published in June 2025, it alone regulates, licenses, registers and supervises financial institutions, and it also oversees payment systems. Its supervision pages cover banks, insurers, exchange bureaux, microfinance institutions and payment service providers. Confirm which of its rules reach your organisation with the Banco Central or your counsel.
Must shops and service providers accept card payments?
Decreto n.º 16/2021 requires public and private service providers and commercial establishments operating in the country to install and offer point-of-sale terminals of the dobra24 network, obtained through their bank. Customers may choose whether to use the terminal. The Decree does not mention PCI DSS, so your acquiring bank sets any security validation. Check scope with your bank.
Who licenses and inspects hotels and tour operators?
The Direção Geral de Turismo e Hotelaria, which sits under the Ministry of Environment, Youth and Sustainable Tourism. Its qualification department handles licensing of tourist operators and another directorate inspects tourism activities and companies. Licensed accommodation has to display its operating licence. A management-system certificate does not replace that licence, so keep both current.
Which sectors does the government promote to investors?
The government's investment page lists tourism, fisheries and fish processing, infrastructure such as a deep-water port and airport works, organic cocoa, coffee, pepper and vanilla, and bottled water and fruit processing. It adds special tax benefits for tourism and agriculture. These are the sectors where export buyers and lenders most often ask for ISO, HACCP or similar evidence.
Is there a national accreditation body in São Tomé and Príncipe?
None was found. No São Tomé and Príncipe body appears in the member list of the international accreditation arrangement dated 31 December 2025, so certificates for local clients usually carry accreditation from a body in another economy. Ask any certification body for its accreditation certificate and scope, and check that your buyer accepts it.
Which language are audits in São Tomé and Príncipe run in?
Normally Portuguese, because the Diário da República and the Banco Central publish legislation in it. Settle the working language, interpreter needs and the language of controlled documents with the certification body when applying. Clients are prepared by Sterling from its Johannesburg office, on site where the work needs it and remotely otherwise.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Lei n.º 3/2016 de Protecção de Dados Pessoais — Personal Data Protection Law — www2.camara.leg.br (accessed 23 Oct 2026)
- Lei n.º 03/2025, Lei Orgânica do Banco Central de São Tomé e Príncipe, published in the Diário da República, I Série, n.º 28, of 5 June 2025 after approval by the Assembleia Nacional on 20 March 2025 and promulgation on 22 May 2025; it repeals Lei n.º 08/92 of 3 August. The Law gives the Banco Central exclusive power to regulate, license, register and supervise financial institutions, including corrective measures and administrative sanctions. It also has the Bank regulate and oversee payment systems, supervise entities dealing in gold and foreign currency, protect financial consumers and act as resolution authority. The Bank's own supervision pages list banks, insurance companies, exchange bureaux, microfinance institutions, payment service providers and payment system operators. The Law does not name ISO or other management-system standards. — bcstp.st (accessed 18 Oct 2026)
- Decreto n.º 16/2021, published in the Diário da República, I Série, n.º 93, of 2 December 2021 and listed on the Banco Central's legislation page. It applies to public and private service providers and commercial establishments operating in the national territory and obliges them to install and offer point-of-sale terminals of the dobra24 card network, bought through their bank. Customer use of the terminal is optional. Its preamble places the Decree within Lei n.º 17/2018 of 7 September (the legal regime of the national payment system) and Decreto-Lei n.º 16/2019 (the regime for payment service providers and payment system operators). It does not mention PCI DSS or ISO standards. — bcstp.st (accessed 18 Oct 2026)
- The tourism ministry's site describes the DGTH's qualification department as the service that handles licensing of tourist operators, and its inspection and tourist-games directorate as the service that inspects all activities and companies in the tourism sector. The same site states that licensed tourist accommodation must display its operating licence and points visitors to a website for checking whether an establishment is licensed. It names no management-system standard. — turismo.gov.st (accessed 18 Oct 2026)
- The Regional Government's site lists these regional secretariats together with its Lei Orgânica and its Estatuto Político e Administrativo. The tourism site records that Príncipe has been an autonomous region, formed by the district of Pagué, since 29 April 1995. The pages set out the regional structure and do not name a management-system standard. — principe.gov.st; turismo.gov.st (accessed 18 Oct 2026)
- The page presents opportunities in tourism (sun and sea, hotels and resorts, nature and eco-tourism, converting the old plantation estates), fisheries (semi-industrial fishing, fish processing, shellfish and seafood export), infrastructure (a deep-water port, airport works, civil construction, naval repair and maintenance, bunkering), agriculture (organic cocoa, Robusta and Arabica coffee, organic pepper and vanilla, with special tax benefits for agricultural investment) and other activities (bottled water, tropical fruit and vegetable processing, mini-hydro). It also states that the country offers specific tax benefits for tourism. It names no certification standard. — turismo.gov.st (accessed 18 Oct 2026)
- No national accreditation body for management-system certification found — iaf.nu (accessed 18 Oct 2026)
- Regulamento de Licitações e Contratações Públicas (Lei n.º 8/2009 de 26 de Agosto) and the Government's proposed Lei sobre os Contratos Públicos (Proposta de Lei n.º 23/XII/3.ª/2023) — www2.camara.leg.br (accessed 23 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice