Where we work · Sri Lanka
ISO and GRC certification consulting in Sri Lanka
Achieve ISO and GRC certification in Sri Lanka with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 23 standards, one team
- Accredited certification route
- Mumbai office team
- Effivity and Academy included
Sectors that ask for certification in Sri Lanka
Clients include
ISO and GRC certification in Sri Lanka at a glance
Sri Lanka's certification demand is shaped by a few named authorities and one new data law. The Sri Lanka Accreditation Board, established by Act No. 32 of 2005, accredits certification bodies and laboratories, while the Central Bank of Sri Lanka directs licensed banks to implement ISO/IEC 27001 and to use certified suppliers for security operations. The Personal Data Protection Act, No. 9 of 2022 is being brought into operation in stages, and an Order published in July 2026 appoints 1 January 2027 for its processing and controller obligations. Factories are inspected by the Department of Labour under the Factories Ordinance, food businesses fall under the Food Act, No. 26 of 1980, and the Board of Investment manages export processing zones that host apparel, electronics and rubber-based manufacturing. Demand comes from apparel and textile exporters, banks and finance companies, ICT and business process management firms, food processors and medical device suppliers. Certificates are issued by accredited certification bodies, never by Sterling. Sterling's Mumbai office serves clients in Sri Lanka on-site where the work needs it and remotely otherwise, with 8,100+ client engagements in 60+ countries, 20+ years of experience, and Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Sri Lanka
Each page covers who needs the standard in Sri Lanka, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Social accountability & human rights
Regulators and laws that drive certification in Sri Lanka (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Data Protection Act, No. 9 of 2022 (as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025) Data Protection Authority of Sri Lanka, established under the Act | Operative status as the instruments state it: Part V (the Authority) came into operation on 17 July 2023 (Gazette Extraordinary No. 2341/59) and Parts VI, VIII, IX and X on 1 December 2023 (Gazette Extraordinary No. 2366/08). The 2025 Amendment Act provides that the other provisions come into operation on dates the Minister appoints by Order in the Gazette. Gazette Extraordinary No. 2498/16 of 22 July 2026 appoints 1 January 2027 for sections 2 and 3, Part I (processing of personal data) and Part III (controllers and processors); it names no other Part. The Authority's site says the Act applies to processing within Sri Lanka and to entities outside Sri Lanka that offer goods or services to, or monitor the behaviour of, people in Sri Lanka, and the Authority's powers include recognising certification and certifying bodies in relation to personal data protection. The Act names no ISO standard. | |
| Central Bank of Sri Lanka (CBSL), Bank Supervision Department Licensed commercial banks and licensed specialised banks | Banking Act Directions No. 16 of 2021, Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks (cited by CBSL as amended) — banks shall implement the latest edition of ISO/IEC 27001 and obtain certification from an accredited certification body (for banks that are not domestic systemically important, certification or assurance from an external auditor approved by CBSL where the Board resolves that information security risk is minimal), and implement ISO/IEC 27035, ISO/IEC 22301 and ISO/IEC 20000 with assurance from the internal audit function or an external party approved by the Board; third-party providers of security operations services, and third-party infrastructure that hosts critical or customer-data systems, must hold ISO 27001 certification from an accredited certification body, cloud providers ISO 27017, and third-party owned infrastructure for critical systems in Sri Lanka ISO 22301 certification. 'Accredited certification body' is defined as a management system certification body accredited for the ISO standard by SLAB or by an accreditation body within the international mutual recognition arrangements. CBSL Circular No. 02 of 2025 (7 May 2025) adds reporting of IT and cybersecurity incidents. | ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 |
| Central Bank of Sri Lanka (CBSL) Licensed finance companies | Finance Business Act Directions No. 01 of 2022, Technology Risk Management and Resilience — LFCs shall ensure that third-party providers of security operations services to whom non-public data may be exposed hold ISO 27001 certification for the latest edition from an accredited certification body, and shall appoint a Chief Information Security Officer. | ISO/IEC 27001 |
| Central Bank of Sri Lanka (CBSL) Licensed payment card and mobile payment service providers | Payment and Settlement Systems Act, No. 28 of 2005 and the Payment Cards and Mobile Payment Systems Regulations No. 1 of 2013 — CBSL regulates and supervises service providers and licenses them on conditions set in the licence; the Regulations as gazetted do not name PCI DSS or any ISO standard. | |
| National Medicines Regulatory Authority (NMRA) Medical device manufacturers, importers and distributors | National Medicines Regulatory Authority Act No. 05 of 2015 — medical devices must be registered and licensed; the NMRA's registration dossier requirements require an ISO quality management system certificate: ISO 13485:2016/2021 for medical devices other than listed devices, and ISO 13485:2016/2021 or ISO 9001:2015 for listed devices; foreign manufacturers apply through a local Marketing Authorization Holder. | ISO 13485, ISO 9001 |
| Ministry of Health (Food Act administration) Food manufacturers, handlers and food premises | Food Act, No. 26 of 1980 and the Food (Hygiene) Regulations 2011 — the Regulations apply to all establishments dealing with the processing, transport, distribution, handling, storage or sale of food; they set premises and hygiene requirements and do not name HACCP or an ISO standard. | |
| Central Environmental Authority (CEA) and, for BOI registered industries, the Board of Investment Industries and activities with pollution potential | National Environmental Act No. 47 of 1980 (amended by Acts No. 56 of 1988 and No. 53 of 2000) — no person shall carry out a prescribed activity except under an Environmental Protection Licence; prescribed activities are sorted into four categories; the scheme does not name ISO 14001. | |
| Department of Labour, Industrial Safety Division Factories and workplaces | Factories Ordinance No. 45 of 1942 with amendments — the Division enforces it to secure safety, health and welfare, registers factories, inspects, investigates accidents and complaints, approves building plans and runs safety awareness work; the Department's site names no ISO 45001 requirement. | |
| Sri Lanka Sustainable Energy Authority Energy-intensive consumers | Sri Lanka Sustainable Energy Authority Act, No. 35 of 2007 — provides for benchmarks, for consumers using energy beyond acceptable limits to submit an audit report by an accredited energy auditor with an action plan, and for registers of accredited energy managers and energy auditors; the Act does not name ISO 50001. | |
| Sri Lanka Standards Institution (SLSI) Manufacturers using the SLS mark | Sri Lanka Standards Act No. 6 of 1984 empowers SLSI to operate the SLS mark product certification scheme — the applicant needs a quality management system based on ISO 9001 or SLSI's own guideline, ISO 9001 certification is mandatory for foreign manufacturers, and the Consumer Affairs Authority has made the SLS mark compulsory for listed products under the Consumer Protection Act No. 01 of 1979. | ISO 9001 |
| Commission to Investigate Allegations of Bribery or Corruption Companies and public bodies exposed to bribery risk | Anti-Corruption Act, No. 9 of 2023 — gives effect to provisions of the United Nations Convention against Corruption and empowers the Commission to introduce codes of conduct for the prevention and eradication of bribery and corruption that private sector entities shall adhere to; the Act does not name ISO 37001 or ISO 37301. | |
| Department of Labour Employers, including garment and other export factories | Labour legislation listed by the Department includes the National Minimum Wage of Workers Act, No. 3 of 2016, the Maternity Benefits Ordinance, the Employment of Women, Young Persons and Children legislation, the Termination of Employment of Workmen legislation, the Trade Unions Ordinance, the Industrial Disputes Act, the Shop and Office Employees legislation, the Wages Boards Ordinance and the Factories Ordinance; the Department states that a person under 16 is a child and cannot be employed except in light family agricultural work outside school hours, that employment under 18 in hazardous work is prohibited, and that women's night work in industrial undertakings needs the Commissioner of Labour's prior written permission. |
Accreditation and recognition
- Sri Lanka Accreditation Board for Conformity Assessment (SLAB): National accreditation authority, established under the Sri Lanka Accreditation Board for Conformity Assessment Act, No. 32 of 2005 and functioning under the Ministry of Trade, Commerce, Food Security and Co-operative Development; accredits testing and calibration and medical laboratories, inspection bodies, proficiency testing providers, management system, product and personnel certification bodies, and validation and verification bodies.
- Sri Lanka Standards Institution (SLSI): Statutory body under the Sri Lanka Standards Act No. 6 of 1984 that publishes Sri Lanka Standards and operates the SLS mark product certification scheme.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Procurement Guidelines 2024 for Goods, Works and Non-consulting Services, with standard bidding documents (National Procurement Commission and the Ministry of Finance (guidelines and manuals listed on the Treasury's procurement page)): The Treasury lists the Procurement Guidelines 2024 and the manuals and bidding documents used with them. Eligibility criteria and the evidence required, including any quality, security or environmental certificate, are set in each bidding document; read the qualification clause of the tender you are bidding on.
Economic zones
- Board of Investment zones (Board of Investment of Sri Lanka Law No. 04 of 1978): export-oriented manufacturing
- Katunayake Export Processing Zone: apparel, electronics, rubber-based products, precision manufacturing
- Port City Colombo Special Economic Zone: services, business and financial services
Sterling in Sri Lanka
Sterling delivers in Sri Lanka from its Mumbai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Sri Lanka, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Sri Lankan clients ask
Is Sri Lanka's data protection law in force yet?
Partly, in stages. The Authority provisions of the Personal Data Protection Act, No. 9 of 2022 came into operation in July 2023 and further Parts in December 2023, and Gazette Extraordinary No. 2498/16 of 22 July 2026 sets 1 January 2027 for sections 2 and 3, Part I and Part III. The Order is silent on other Parts, so ask the Data Protection Authority what applies today.
Which accreditation should a certification body hold for Sri Lanka?
Look for accreditation from the Sri Lanka Accreditation Board, established by Act No. 32 of 2005. Its own site shows recognition for management systems covering quality, environment, food safety, energy and occupational health and safety. Information security is listed on its scheme page but not in that recognition list, so ask the certification body for its accreditation certificate and scope.
Does the Central Bank of Sri Lanka require ISO 27001 from banks?
For licensed banks, yes: Banking Act Directions No. 16 of 2021 require implementation of the latest edition of ISO/IEC 27001 with certification from an accredited certification body, or assurance from an approved external auditor for banks that are not domestic systemically important where the Board finds the risk minimal. Security operations suppliers must also be certified. Check your licence category with the Central Bank.
Are audits in Sri Lanka conducted in English?
Usually the reports and documents are in English, which the Constitution names as the link language beside Sinhala and Tamil. Interviews with operators and workers may take place in Sinhala or Tamil. Settle the audit language, any interpreter and the language of controlled documents with the certification body at application, so that the audit team is matched to the sites.
Which labour laws sit behind ethical-trade audits in Sri Lanka?
The Department of Labour lists the National Minimum Wage of Workers Act, No. 3 of 2016, the Maternity Benefits Ordinance, legislation on women, young persons and children, and the Factories Ordinance among others. It states that a person under 16 is a child and that hazardous work is prohibited under 18. Auditors compare practice with these laws, so confirm current wording with the Department.
How do Poya days and the New Year affect audit scheduling?
They move the calendar, so plan early. Full-moon Poya days, the Sinhala and Tamil New Year and other public and mercantile holidays follow the lunar calendar or are announced each year, and export peaks and factory shifts add further constraints. Tell the certification body which sites you run when you apply so audit dates avoid closures rather than relying on a fixed calendar.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Act, No. 9 of 2022 (as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025) — dpa.gov.lk (accessed 11 Oct 2026)
- Banking Act Directions No. 16 of 2021, Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks (cited by CBSL as amended) — cbsl.gov.lk (accessed 11 Oct 2026)
- Finance Business Act Directions No. 01 of 2022, Technology Risk Management and Resilience — cbsl.gov.lk (accessed 11 Oct 2026)
- Payment and Settlement Systems Act, No. 28 of 2005 and the Payment Cards and Mobile Payment Systems Regulations No. 1 of 2013 — cbsl.gov.lk (accessed 11 Oct 2026)
- National Medicines Regulatory Authority Act No. 05 of 2015 — nmra.gov.lk (accessed 11 Oct 2026)
- Food Act, No. 26 of 1980 and the Food (Hygiene) Regulations 2011 — eohfs.health.gov.lk (accessed 11 Oct 2026)
- National Environmental Act No. 47 of 1980 (amended by Acts No. 56 of 1988 and No. 53 of 2000) — cea.lk (accessed 11 Oct 2026)
- Factories Ordinance No. 45 of 1942 with amendments — labourdept.gov.lk (accessed 11 Oct 2026)
- Sri Lanka Sustainable Energy Authority Act, No. 35 of 2007 — energy.gov.lk (accessed 11 Oct 2026)
- Sri Lanka Standards Act No. 6 of 1984 empowers SLSI to operate the SLS mark product certification scheme — slsi.lk (accessed 11 Oct 2026)
- Anti-Corruption Act, No. 9 of 2023 — parliament.lk (accessed 11 Oct 2026)
- Labour legislation listed by the Department includes the National Minimum Wage of Workers Act, No. 3 of 2016, the Maternity Benefits Ordinance, the Employment of Women, Young Persons and Children legislation, the Termination of Employment of Workmen legislation, the Trade Unions Ordinance, the Industrial Disputes Act, the Shop and Office Employees legislation, the Wages Boards Ordinance and the Factories Ordinance; the Department states that a person under 16 is a child and cannot be employed except in light family agricultural work outside school hours, that employment under 18 in hazardous work is prohibited, and that women's night work in industrial undertakings needs the Commissioner of Labour's prior written permission — labourdept.gov.lk (accessed 11 Oct 2026)
- Sri Lanka Accreditation Board for Conformity Assessment (SLAB) — slab.lk (accessed 11 Oct 2026)
- Sri Lanka Standards Institution (SLSI) — slsi.lk (accessed 11 Oct 2026)
- Procurement Guidelines 2024 for Goods, Works and Non-consulting Services, with standard bidding documents — treasury.gov.lk (accessed 11 Oct 2026)
- Board of Investment zones (Board of Investment of Sri Lanka Law No. 04 of 1978) — investsrilanka.com; cea.lk (accessed 11 Oct 2026)
- Katunayake Export Processing Zone — investsrilanka.com (accessed 11 Oct 2026)
- Port City Colombo Special Economic Zone — portcitycolombo.lk (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Navi Mumbai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
india@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice