Where we work · Seychelles
ISO and GRC certification consulting in Seychelles
Achieve ISO and GRC certification in Seychelles with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Seychelles
Clients include
In short
ISO and GRC certification in Seychelles at a glance
Buyers of Seychelles fish ask how every consignment was handled, and that export chain shapes much of the demand for ISO and GRC work. The Export of Fishery Products Act 1996 and the Sanitary Regulations 2010 require a permit for export establishments and an own-checks system built on HACCP principles, with official control by the Fish Inspection and Quality Control Unit of the Seychelles Bureau of Standards. Hotels and island resorts work to the Tourism Development (Standards) Regulations 2023. Banks follow the Central Bank of Seychelles Cyber Security Guidelines and Outsourcing Guidelines, and the Financial Services Authority regulates fiduciary, insurance and capital-markets firms. The Information Commission enforces the Data Protection Act 2023, SADCAS lists Seychelles among its member states, and public tenders set qualification evidence in each bidding document. Certificates come from accredited certification bodies, never from Sterling. Sterling's Dubai office serves clients across Seychelles, drawing on 8,100+ client engagements in 60+ countries, 20+ years of practice, and Effivity and Sterling Academy included with every engagement.
Explore
ISO and GRC standards Sterling delivers in Seychelles
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
ISO/IEC 27701Sterling guide to the standardSeychelles Data Protection Act 2023Sterling guide to the standard
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
ISO 22301Sterling guide to the standardISO 37001Sterling guide to the standardISO 37301Sterling guide to the standard
Financial services, payments & AML
Food safety & agriculture
FSSC 22000Sterling guide to the standardHACCPSterling guide to the standardISO 22000Sterling guide to the standard
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Seychelles (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Data Protection Act 2023 Information Commission, the competent authority to enforce and implement the Act under section 5(1) | Applies to processing by automatic or semi-automatic means and to non-automatic processing within Seychelles where the data forms part of a filing system; it does not apply to processing by relevant authorities in a criminal investigation, to national security matters or to purely personal activity. It sets principles (lawful basis, purpose limitation, minimisation, accuracy, storage limitation), consent conditions, rights to be informed, to access, rectify, delete, object and port data, a written contract for processors, records of processing, privacy by design, a data protection impact assessment before high-risk processing with prior consultation of the Commission where high risk remains, security measures, notification of a breach to the Commission not later than 72 hours after becoming aware of it, a data protection officer where core activities involve large-scale monitoring or special categories, and conditions for transfers outside Seychelles. The section headings contain no general registration regime. Existing controllers and processors have a transitional period from the Act's coming into operation to conform. The Act repeals the earlier Data Protection Act (Cap 57) and does not cite any ISO standard. | |
| Information Commission guidance and enquiries Information Commission | The Commission describes itself as the statutory body responsible for implementing, monitoring and enforcing the Data Protection Act, 2023; it can investigate complaints and breaches, conduct audits, issue enforcement notices and impose administrative fines, and it provides education and outreach on data protection rights and obligations. Its page takes enquiries on topics such as the designation of data protection officers. No regulations under the Act are listed on the page. | |
| Fish Inspection and Quality Control Unit of the Seychelles Bureau of Standards, defined as the competent authority in the Sanitary Regulations; the Chief Executive Officer of the Bureau exercises the Act's responsibilities through it Fish and fishery product exporters: processing establishments, freezer and factory vessels, and landing for export | Export of Fishery Products Act, 1996 (Act 18 of 1996, Cap 77A) and the Export of Fishery Products (Sanitary) Regulations, 2010 (SI 82 of 2010, as amended by SI 55 of 2011). No fishery product may be exported for human consumption unless prepared, processed or packed in an establishment or vessel holding a permit under section 3 of the Act, and exports must be landed at a landing site designated by the competent authority; an Order made under the Regulations in December 2015 listed Victoria Fishing Port and Providence Artisanal Fishing Port, and the Gazette site also lists an Export of Fishery Products (Designated Landing Sites) Order 2022 (SI 10 of 2022). Operators must run an own-checks system built on hazard identification and HACCP principles, with staff trained in them, keep the records for the competent authority, and withdraw non-compliant product. The competent authority carries out official control and may issue a certificate for a batch. Testing laboratories nominated for official control must comply with ISO 17025. The Regulations name HACCP principles and ISO 17025 and no other ISO standard. | HACCP, ISO/IEC 17025 |
| Seychelles Fishing Authority (SFA) Fisheries, port and catch documentation | The SFA's own site states its mission as optimal use of fisheries resources for the benefit of the Seychellois people and lists a Port Management and Development department, a Fisheries Information Management System and a Catch Certificate Office. Its site does not describe the export-permit regime, which the Export of Fishery Products Act places with the Seychelles Bureau of Standards. | |
| Central Bank of Seychelles (CBS) Banks, credit unions and other institutions regulated by the Central Bank of Seychelles | Cyber Security Guidelines for deposit-taking financial institutions (CBS letter ref FSO/GENII dated April 09, 2019), which cover cyber security policy and governance, cyber-risk assessment, independent security assessment, incident response, supply chain management and reporting of significant incidents to the CBS; and Outsourcing Guidelines for Banks and Other Financial Institutions (December 2021), which require authorisation from the CBS before an outsourcing arrangement and cover agreements, due diligence, business continuity and data confidentiality under the Financial Institutions Act, 2004 and section 11 of the National Payment System Act, 2014. Neither document names an ISO standard. | |
| Financial Services Authority (FSA) Fiduciary, insurance, capital markets, international trade zone and other non-bank financial services | The FSA's site lists regulated entity categories (fiduciary, international trade zone, hire purchase and credit sales, insurance, collective investment schemes, capital markets, gambling, regulatory sandbox) and virtual asset service providers. Its Guidelines page lists Business Continuity Plan Guidelines under several sector headings; the page lists the titles only and shows no cyber-security guideline. | |
| Ministry responsible for tourism (the Department of Tourism sits within it); licences are issued by the Seychelles Licensing Authority or the Seychelles Maritime Safety Authority Hotels, island resorts, guesthouses, self-catering establishments, restaurants and other tourism enterprises | Tourism Development Act, 2019 (Act 8 of 2019) and the Tourism Development (Standards) Regulations, 2023 (SI 84 of 2023). The Ministry classifies and grades establishments under the Seychelles National Classification System and Seychelles Secrets Standards, inspects at least once a year, and sets minimum requirements in the Schedules, including safety and security, fire drills and first aid, kitchen standards, pest control, medical fitness of food handlers and a crisis management plan for hotels. Hotels must also comply with other regulators, including the Seychelles Bureau of Standards. The visible text does not mention HACCP, ISO or any management-system certificate. | |
| Ministry administering the Employment Act (the Director), with enforcement officers appointed by the Minister All employers | Occupational Safety and Health Decree, 1978 (Decree 54 of 1978), consolidated text as published on SeyLII with amendments up to 2014: employers must protect the health, safety and welfare of employees, provide safe plant, systems of work and workplace, information, training and protective equipment, and take care for people other than employees. Enforcement officers can inspect and serve improvement and prohibition notices. The Ministry's labour compliance page refers to the occupational safety and health laws and to accident reporting to the Ministry. The Decree does not cite ISO 45001. | |
| Ministry responsible for the environment Industry and developers whose activities affect the environment | Environment Protection Act, 2016, which repeals the earlier Environment Protection Act and has subsidiary legislation listed on SeyLII. The Act and its subsidiary legislation set the licences and assessments that apply to industry; it is not recorded as citing ISO 14001. | |
| Minister responsible, with the competent authorities named in the Act Operators of computer systems, online service providers and their customers | Cybercrimes and other Related Crimes Act, 2021 (Act 59 of 2021), published in the Supplement to the Official Gazette on 15 December 2021; section 1 provides that it takes effect on a date the Minister sets by Gazette notice. It creates offences against computer systems and data, requires a 24-hour point of contact for investigative assistance and gives service providers no general duty to monitor data. It does not mention critical infrastructure, a computer emergency response team or a general incident-reporting duty, and it cites no ISO standard. | |
| Anti-Corruption Commission of Seychelles All private entities and public bodies | Anti-Corruption Act, 2016 (Act 2 of 2016, promulgated 04 April 2016), listed on SeyLII with its 2017 and 2019 amendments. It is not recorded as citing ISO 37001 or ISO 37301. | |
| Utilities Regulatory Commission Electricity, water and sewerage utilities and large energy users | Utilities Regulatory Commission Act, 2023 (Act 12 of 2023), brought into operation on 18 October 2024 by the Utilities Regulatory Commission Act 2023 (Commencement) Notice 2024 (SI 79 of 2024). The Commission's functions include licensing in the energy, water and sewerage sectors, determining standards of service, proposing energy efficiency standards, promoting efficiency in the use of regulated services and undertaking inspections. The Energy Act, 2012 (Act 11 of 2012) is shown on SeyLII as repealed on 18 October 2024 by this Act. The Act does not cite ISO 50001. |
Accreditation and recognition
- Southern African Development Community Accreditation Service (SADCAS): Regional accreditation body whose member states, as its website shows, include Seychelles; its Seychelles page lists focal points at the Seychelles Bureau of Standards and the organisations accredited there, which are an inspection body, testing laboratories, a calibration (mass metrology) laboratory and a pharmaceutical quality control laboratory, including public laboratories.
- Seychelles Bureau of Standards (SBS): National standards body under the Seychelles Bureau of Standards Act, 2014 (Act 2 of 2014), which repealed the 1987 Act: it prepares draft standards and declares them as Seychelles Standards, and appointed inspectors verify the conformity of goods, processes or services with mandatory standards. The Bureau is also named as the competent authority for fishery product exports in the Sanitary Regulations.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public Procurement Act, 2008 (Act 33 of 2008) and the National Tender Board (Procurement Oversight Unit (policy and monitoring) and National Tender Board (opens bids and approves awards)): Bidders must meet eligibility criteria, and a procuring entity may require qualifications such as professional and technical skills, equipment, personnel and past performance, with the evidence listed in the bidding documents and assessed on a pass or fail basis. Technical requirements must be based on national or international standards. The Act has no general certification requirement, so read the qualification clause of each tender.
Economic zones
- International trade zones under the International Trade Zone Act, 1995 (Act 8 of 1995): trading and distribution, light manufacturing and packing, logistics
Sterling in Seychelles
Sterling delivers in Seychelles from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Seychelles clients ask
Who controls fishery product exports from Seychelles?
The Sanitary Regulations define the competent authority as the Fish Inspection and Quality Control Unit of the Seychelles Bureau of Standards. Under the Export of Fishery Products Act 1996, establishments and vessels need a permit before they export, and exports must be landed at a designated site. Ask the Bureau which permit conditions apply to your operation.
Does Seychelles have a data protection law?
Yes. The Data Protection Act 2023, Act 24 of 2023, was assented to on 19 December 2023 and repeals the earlier Act. The Information Commission enforces it. It sets principles, individual rights, impact assessments, breach notification to the Commission and conditions for sending data abroad. Confirm how it applies to your processing with your counsel or the Commission.
Must Seychelles banks follow cyber security rules?
Banks and credit unions are expected to adopt the Central Bank of Seychelles Cyber Security Guidelines, issued in April 2019, which cover governance, risk assessment, independent security assessment, incident response and reporting significant incidents. The Outsourcing Guidelines add prior authorisation for outsourcing. Neither names an ISO standard, so ask the Central Bank how it expects your institution to evidence compliance.
Is there an accreditation body for Seychelles?
SADCAS, the regional accreditation service, lists Seychelles among its member states, and its Seychelles page shows accredited laboratories and an inspection body, with focal points at the Seychelles Bureau of Standards. For a management system certificate, ask the certification body for its accreditation certificate and scope, and check what your buyer accepts.
Are certification audits in Seychelles conducted in English?
Usually, yes. Creole, English and French are the national languages, and legislation and standards are published in English, so audits normally run in English with interviews in Creole or French where staff prefer. Agree the audit language and any interpreter with the certification body when you apply, because the body decides what it can staff.
Next step
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act 2023 — gazette.sc; infocom.sc (accessed 17 Oct 2026)
- Information Commission guidance and enquiries — infocom.sc (accessed 17 Oct 2026)
- Export of Fishery Products Act, 1996 (Act 18 of 1996, Cap 77A) and the Export of Fishery Products (Sanitary) Regulations, 2010 (SI 82 of 2010, as amended by SI 55 of 2011). No fishery product may be exported for human consumption unless prepared, processed or packed in an establishment or vessel holding a permit under section 3 of the Act, and exports must be landed at a landing site designated by the competent authority; an Order made under the Regulations in December 2015 listed Victoria Fishing Port and Providence Artisanal Fishing Port, and the Gazette site also lists an Export of Fishery Products (Designated Landing Sites) Order 2022 (SI 10 of 2022). Operators must run an own-checks system built on hazard identification and HACCP principles, with staff trained in them, keep the records for the competent authority, and withdraw non-compliant product. The competent authority carries out official control and may issue a certificate for a batch. Testing laboratories nominated for official control must comply with ISO 17025. The Regulations name HACCP principles and ISO 17025 and no other ISO standard. — faolex.fao.org; seylii.org (accessed 17 Oct 2026)
- The SFA's own site states its mission as optimal use of fisheries resources for the benefit of the Seychellois people and lists a Port Management and Development department, a Fisheries Information Management System and a Catch Certificate Office. Its site does not describe the export-permit regime, which the Export of Fishery Products Act places with the Seychelles Bureau of Standards. — sfa.sc (accessed 17 Oct 2026)
- Cyber Security Guidelines for deposit-taking financial institutions (CBS letter ref FSO/GENII dated April 09, 2019), which cover cyber security policy and governance, cyber-risk assessment, independent security assessment, incident response, supply chain management and reporting of significant incidents to the CBS; and Outsourcing Guidelines for Banks and Other Financial Institutions (December 2021), which require authorisation from the CBS before an outsourcing arrangement and cover agreements, due diligence, business continuity and data confidentiality under the Financial Institutions Act, 2004 and section 11 of the National Payment System Act, 2014. Neither document names an ISO standard. — cbs.sc (accessed 17 Oct 2026)
- The FSA's site lists regulated entity categories (fiduciary, international trade zone, hire purchase and credit sales, insurance, collective investment schemes, capital markets, gambling, regulatory sandbox) and virtual asset service providers. Its Guidelines page lists Business Continuity Plan Guidelines under several sector headings; the page lists the titles only and shows no cyber-security guideline. — fsaseychelles.sc (accessed 17 Oct 2026)
- Tourism Development Act, 2019 (Act 8 of 2019) and the Tourism Development (Standards) Regulations, 2023 (SI 84 of 2023). The Ministry classifies and grades establishments under the Seychelles National Classification System and Seychelles Secrets Standards, inspects at least once a year, and sets minimum requirements in the Schedules, including safety and security, fire drills and first aid, kitchen standards, pest control, medical fitness of food handlers and a crisis management plan for hotels. Hotels must also comply with other regulators, including the Seychelles Bureau of Standards. The visible text does not mention HACCP, ISO or any management-system certificate. — gazette.sc (accessed 17 Oct 2026)
- Occupational Safety and Health Decree, 1978 (Decree 54 of 1978), consolidated text as published on SeyLII with amendments up to 2014: employers must protect the health, safety and welfare of employees, provide safe plant, systems of work and workplace, information, training and protective equipment, and take care for people other than employees. Enforcement officers can inspect and serve improvement and prohibition notices. The Ministry's labour compliance page refers to the occupational safety and health laws and to accident reporting to the Ministry. The Decree does not cite ISO 45001. — seylii.org; employment.gov.sc (accessed 17 Oct 2026)
- Environment Protection Act, 2016, which repeals the earlier Environment Protection Act and has subsidiary legislation listed on SeyLII. The Act and its subsidiary legislation set the licences and assessments that apply to industry; it is not recorded as citing ISO 14001. — seylii.org (accessed 17 Oct 2026)
- Cybercrimes and other Related Crimes Act, 2021 (Act 59 of 2021), published in the Supplement to the Official Gazette on 15 December 2021; section 1 provides that it takes effect on a date the Minister sets by Gazette notice. It creates offences against computer systems and data, requires a 24-hour point of contact for investigative assistance and gives service providers no general duty to monitor data. It does not mention critical infrastructure, a computer emergency response team or a general incident-reporting duty, and it cites no ISO standard. — seylii.org (accessed 17 Oct 2026)
- Anti-Corruption Act, 2016 (Act 2 of 2016, promulgated 04 April 2016), listed on SeyLII with its 2017 and 2019 amendments. It is not recorded as citing ISO 37001 or ISO 37301. — old.seylii.org (accessed 17 Oct 2026)
- Utilities Regulatory Commission Act, 2023 (Act 12 of 2023), brought into operation on 18 October 2024 by the Utilities Regulatory Commission Act 2023 (Commencement) Notice 2024 (SI 79 of 2024). The Commission's functions include licensing in the energy, water and sewerage sectors, determining standards of service, proposing energy efficiency standards, promoting efficiency in the use of regulated services and undertaking inspections. The Energy Act, 2012 (Act 11 of 2012) is shown on SeyLII as repealed on 18 October 2024 by this Act. The Act does not cite ISO 50001. — faolex.fao.org; gazette.sc; seylii.org (accessed 17 Oct 2026)
- Southern African Development Community Accreditation Service (SADCAS) — sadcas.org (accessed 17 Oct 2026)
- Seychelles Bureau of Standards (SBS) — seylii.org; faolex.fao.org (accessed 17 Oct 2026)
- Public Procurement Act, 2008 (Act 33 of 2008) and the National Tender Board — finance.gov.sc (accessed 17 Oct 2026)
- International trade zones under the International Trade Zone Act, 1995 (Act 8 of 1995) — seylii.org; fsaseychelles.sc (accessed 17 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice