Where we work · Tajikistan
ISO and GRC certification consulting in Tajikistan
Achieve ISO and GRC certification in Tajikistan with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Tajikistan
Clients include
ISO and GRC certification in Tajikistan at a glance
Compliance work in Tajikistan starts from a short list of laws. The Law on Personal Data Protection, No. 1537 of 3 August 2018, rests on consent, access rights, local storage of databases and security duties, and leaves the supervisory body to be designated by the President. The Food Safety Law of 2012 obliges producers to run hazard analysis and critical control points or equivalent systems, while the National Bank of Tajikistan licenses payment system operators under the Law on Payment Services and the Payment System. Demand comes from banks and payment providers, IT park and outsourcing firms, food processors, aluminium and mining producers, light industry, construction suppliers and the five free economic zones. Accreditation under the Law on Conformity Assessment is voluntary and handled by a state body that the Government designates, so certificates for Tajik organisations usually carry accreditation from another economy and are issued by accredited certification bodies, never by Sterling. Sterling serves clients across Tajikistan from its Dubai office, on-site where the work needs it and remotely otherwise, with 8,100+ client engagements in 60+ countries and Effivity and Sterling Academy included.
ISO and GRC standards Sterling delivers in Tajikistan
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Tajikistan (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law of the Republic of Tajikistan "On Personal Data Protection" (Закон Республики Таджикистан «О защите персональных данных»), No. 1537 of 3 August 2018 The authorised state body for personal data protection, which the President of Tajikistan designates and whose regulation he approves; the Law does not name the body. Its powers include applying state policy, drafting regulations for the President's approval, approving the list of personal data that a holder or operator needs, approving the order for protective measures, considering complaints and naming the people responsible for compliance | Covers the collection, processing and protection of personal data by holders, operators and third parties, with exclusions for personal and family use, archive documents and state secrets. Collection and processing rest on the person's consent, with narrow exceptions for state bodies; data must serve specific lawful purposes and be accurate; people are notified, can reach their data and ask for correction, blocking or destruction; biometric data needs written consent; databases are kept only in Tajikistan unless the authorised body agrees, and cross-border transfers are limited; holders and operators must take measures against unauthorised access, detect it in time and limit its effects; data is destroyed or anonymised when its purpose ends; and collection and processing are tied to a certificate of conformity from the authorised body for personal data protection and information security. | |
| Law of the Republic of Tajikistan "On Information Protection" (О защите информации), No. 71 of 2 December 2002 State bodies of the Government's choosing: the Law refers to a state body authorised by the Government to certify information protection tools and to licensing under the Law on Licensing of Certain Types of Activity; the Law does not name them | Sets the aims and principles of information protection: preventing leaks, theft, loss, distortion, forgery, unauthorised destruction, copying and blocking. Protection tools may be organisational, technical, software, hardware, physical or cryptographic; protection tools must carry a certificate from the state body the Government authorises; activity in the information protection field is licensed under the licensing law. | |
| National Bank of Tajikistan Banks, payment providers and payment system operators | Law "On Payment Services and the Payment System" (Закон «О платёжных услугах и платёжной системе»), No. 1397 of 24 February 2017. The National Bank licenses payment system operators under Article 14 and publishes the lists of domestic and international payment systems. Payment service providers and operators must protect information about their information security measures, personal data and other information that the law protects, and payment system rules must cover information protection, risk management and the continuity of the system. The National Bank's website lists domestic systems such as Korti milli and Oson and international systems including Visa, Mastercard and UnionPay. The Law does not name ISO/IEC 27001 or PCI DSS. | |
| The authorised health body and the authorised agriculture body named by the Food Safety Law; the Ministry of Health and Social Protection of the Population runs a State Supervision Service for Healthcare and Social Protection of the Population Food producers, processors and traders | Law "On Food Safety" (Закон «О безопасности пищевых продуктов»), No. 890 of 1 August 2012. Producers and traders must apply a hazard analysis and critical control points system and/or other safety systems; the health body supervises how these systems are applied, and the agriculture body does the same for products under veterinary and plant health control; certification of food products is voluntary. | HACCP |
| Ministry of Health and Social Protection of the Population Medicines, pharmacies and medical goods | Law "On Medicines and Pharmaceutical Activity" (Закон «О лекарственных средствах и фармацевтической деятельности»), No. 39 of 6 August 2001. Medicines and medical goods are produced, sold and used after state registration under the procedure the Ministry sets, and their production is carried out by entities holding a pharmaceutical licence. The Law does not name ISO 13485. | |
| The state bodies for standardisation and for accreditation that the Government designates; the Laws do not name them Standards, accreditation and conformity assessment | Law "On Standardisation" No. 668 of 29 December 2010 (application of standards is voluntary, unless a technical regulation makes a standard its sole route to compliance) and Law "On Conformity Assessment" No. 759 of 2 August 2011 (accreditation is formal recognition by the state accreditation body; accreditation is voluntary; accreditation and certification may not be combined in one body; voluntary certification is done by a body accredited by the state accreditation body, at the applicant's initiative). | |
| The authorised state body for energy saving and energy efficiency named in the Law Energy users and energy suppliers | Law "On Energy Saving and Energy Efficiency" (Закон «Об энергосбережении и энергоэффективности»), No. 1018 of 19 September 2013. Energy surveys are mandatory for state bodies, organisations that produce, transport and distribute energy resources, organisations whose annual spending on energy passes the Government's threshold, and organisations funded from the state budget for energy saving. The Law does not name ISO 50001. | |
| The authorised state bodies for labour protection and industrial safety named in the Labour Code and the industrial safety Law Employers and operators of hazardous production facilities | Labour Code No. 1329 of 23 July 2016 (employer duties for safe workplaces, hazard prevention, protective equipment, training, workplace assessment and investigation of accidents and occupational diseases) and Law "On Industrial Safety of Hazardous Production Facilities" No. 14 of 28 February 2004 (licence for operating a hazardous facility, industrial safety declaration, expert review and liability insurance). Neither names ISO 45001. | |
| The authorised state body for environmental protection named in the environmental laws Businesses with environmental impact | Law "On Environmental Protection" No. 760 of 2 August 2011 (limits and quotas, permits and emission norms), Law "On Environmental Impact Assessment" No. 1448 of 18 July 2017 (mandatory assessment for listed categories of activity) and Law "On Environmental Audit" No. 785 of 26 December 2011 (a licensed audit of legal compliance, separate from an ISO 14001 certificate). None names ISO 14001. | |
| Agency for State Financial Control and Combating Corruption State-owned and majority state-owned enterprises and other anti-corruption subjects | Law "On Combating Corruption" No. 100 of 25 July 2005, as amended, which lists the bodies that fight corruption and the subjects of corruption prevention, including state economic entities and entities in which the state holds at least half of the property, and Law "On the Agency for State Financial Control and Combating Corruption" No. 374 of 20 March 2008. Neither names ISO 37001. | |
| Agency for Innovation and Digital Technologies under the President of the Republic of Tajikistan Digital services, IT park residents, outsourcing and artificial intelligence | The State Committee on Investment and State Property Management describes the Agency as the authorised state body for innovation and the digital transition, records an IT park opened in 2024 and a Government strategy for the development of artificial intelligence until 2040 adopted in 2022, and notes that outsourcing and fintech are developing. No management system standard is named. |
Accreditation and recognition
- State accreditation body designated by the Government (the Law does not name it): Under the Law on Conformity Assessment No. 759 of 2 August 2011 the state accreditation body grants accreditation as formal recognition of competence, issues accreditation certificates, keeps the national accreditation register, inspects accredited bodies and takes part in international accreditation organisations; accreditation is voluntary and the accreditation function may not be combined with certification in one body.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- State procurement of goods, works and services (Procuring organisations under the Law "On State Procurement of Goods, Works and Services" No. 168 of 3 March 2006, with an authorised procurement body): A supplier must show professional and technical competence, experience and reputation, financial resources, equipment and other capacity, must not be insolvent, bankrupt or in suspension of business, must have no tax arrears, must not be on the register of unreliable suppliers and must be legally capable of contracting. The procuring organisation sets these tests in the tender documents and may not add other criteria that discriminate between suppliers. The Law does not name ISO certificates.
Economic zones
- Free Economic Zone Sughd: industrial and innovative activities
- Free Economic Zone Dangara: industrial and innovative activities
- Free Economic Zone Kulob: industrial and innovative activities
- Free Economic Zone Panj: industrial and innovative activities
- Free Economic Zone Ishkoshim: industrial and innovative activities
Sterling in Tajikistan
Sterling delivers in Tajikistan from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Tajikistan clients ask
Does Tajikistan have a personal data protection law?
Yes. The Law on Personal Data Protection, No. 1537 of 3 August 2018, governs how personal data is collected, processed and protected. It rests on consent, gives people access and correction rights, keeps databases in Tajikistan unless agreed otherwise and limits cross-border transfers. The supervisory body is designated by the President and is not named in the Law. Ask your counsel how it applies to your processing.
Are certification audits in Tajikistan conducted in English?
They can be, but language needs planning. Tajik is the state language, Russian is the language of interethnic communication, and organisations keep their official records in the state language. Agree the audit language, any interpreter and the translations that auditors need with the certification body at application, and say early which interviews will run in Tajik or Russian.
Does Tajik law require food businesses to apply HACCP?
Yes. The Food Safety Law of 2012 obliges producers and traders to put in place a hazard analysis and critical control points system and/or other safety systems, and the health authority, together with the agriculture authority for products under veterinary and plant health control, supervises how they are applied. Certification of food products is voluntary. Check your product category with the authorities.
Which body accredits certification bodies in Tajikistan?
The Law on Conformity Assessment provides for a state accreditation body designated by the Government. It grants accreditation, keeps the register and inspects accredited bodies, and it may not also certify. Accreditation is voluntary. The Law does not name the body, so ask any certification body for its accreditation certificate and scope, and confirm who issued it.
Do free economic zones change certification needs?
The zones at Sughd, Dangara, Kulob, Panj and Ishkoshim give registered subjects a special legal regime for taxation, currency, customs and labour relations under the Law on Free Economic Zones. Certification is a separate question, decided by your customers and regulators rather than by zone registration. Ask the zone administration which approvals apply to your activity.
Must suppliers to public buyers hold ISO certificates?
The State Procurement Law lists the qualification tests: technical and professional competence, experience, financial resources, equipment, solvency, no tax arrears, no entry on the unreliable-suppliers register and legal capacity. Buyers set these in tender documents and may not add other discriminating criteria. Read each tender's qualification section to see whether a certificate is accepted as evidence.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law of the Republic of Tajikistan "On Personal Data Protection" (Закон Республики Таджикистан «О защите персональных данных»), No. 1537 of 3 August 2018 — base.mmk.tj (accessed 18 Oct 2026)
- Law of the Republic of Tajikistan "On Information Protection" (О защите информации), No. 71 of 2 December 2002 — base.mmk.tj (accessed 18 Oct 2026)
- Law "On Payment Services and the Payment System" (Закон «О платёжных услугах и платёжной системе»), No. 1397 of 24 February 2017. The National Bank licenses payment system operators under Article 14 and publishes the lists of domestic and international payment systems. Payment service providers and operators must protect information about their information security measures, personal data and other information that the law protects, and payment system rules must cover information protection, risk management and the continuity of the system. The National Bank's website lists domestic systems such as Korti milli and Oson and international systems including Visa, Mastercard and UnionPay. The Law does not name ISO/IEC 27001 or PCI DSS — base.mmk.tj; nbt.tj (accessed 18 Oct 2026)
- Law "On Food Safety" (Закон «О безопасности пищевых продуктов»), No. 890 of 1 August 2012. Producers and traders must apply a hazard analysis and critical control points system and/or other safety systems; the health body supervises how these systems are applied, and the agriculture body does the same for products under veterinary and plant health control; certification of food products is voluntary — base.mmk.tj; moh.tj (accessed 18 Oct 2026)
- Law "On Medicines and Pharmaceutical Activity" (Закон «О лекарственных средствах и фармацевтической деятельности»), No. 39 of 6 August 2001. Medicines and medical goods are produced, sold and used after state registration under the procedure the Ministry sets, and their production is carried out by entities holding a pharmaceutical licence. The Law does not name ISO 13485 — base.mmk.tj; moh.tj (accessed 18 Oct 2026)
- Law "On Standardisation" No. 668 of 29 December 2010 (application of standards is voluntary, unless a technical regulation makes a standard its sole route to compliance) and Law "On Conformity Assessment" No. 759 of 2 August 2011 (accreditation is formal recognition by the state accreditation body; accreditation is voluntary; accreditation and certification may not be combined in one body; voluntary certification is done by a body accredited by the state accreditation body, at the applicant's initiative) — base.mmk.tj (accessed 18 Oct 2026)
- Law "On Energy Saving and Energy Efficiency" (Закон «Об энергосбережении и энергоэффективности»), No. 1018 of 19 September 2013. Energy surveys are mandatory for state bodies, organisations that produce, transport and distribute energy resources, organisations whose annual spending on energy passes the Government's threshold, and organisations funded from the state budget for energy saving. The Law does not name ISO 50001 — base.mmk.tj (accessed 18 Oct 2026)
- Labour Code No. 1329 of 23 July 2016 (employer duties for safe workplaces, hazard prevention, protective equipment, training, workplace assessment and investigation of accidents and occupational diseases) and Law "On Industrial Safety of Hazardous Production Facilities" No. 14 of 28 February 2004 (licence for operating a hazardous facility, industrial safety declaration, expert review and liability insurance). Neither names ISO 45001 — base.mmk.tj (accessed 18 Oct 2026)
- Law "On Environmental Protection" No. 760 of 2 August 2011 (limits and quotas, permits and emission norms), Law "On Environmental Impact Assessment" No. 1448 of 18 July 2017 (mandatory assessment for listed categories of activity) and Law "On Environmental Audit" No. 785 of 26 December 2011 (a licensed audit of legal compliance, separate from an ISO 14001 certificate). None names ISO 14001 — base.mmk.tj (accessed 18 Oct 2026)
- Law "On Combating Corruption" No. 100 of 25 July 2005, as amended, which lists the bodies that fight corruption and the subjects of corruption prevention, including state economic entities and entities in which the state holds at least half of the property, and Law "On the Agency for State Financial Control and Combating Corruption" No. 374 of 20 March 2008. Neither names ISO 37001 — base.mmk.tj (accessed 18 Oct 2026)
- The State Committee on Investment and State Property Management describes the Agency as the authorised state body for innovation and the digital transition, records an IT park opened in 2024 and a Government strategy for the development of artificial intelligence until 2040 adopted in 2022, and notes that outsourcing and fintech are developing. No management system standard is named — investcom.tj (accessed 18 Oct 2026)
- State accreditation body designated by the Government (the Law does not name it) — base.mmk.tj (accessed 18 Oct 2026)
- State procurement of goods, works and services — base.mmk.tj (accessed 18 Oct 2026)
- Free Economic Zone Sughd — base.mmk.tj; fez.tj
- Free Economic Zone Dangara — fez.tj
- Free Economic Zone Kulob — fez.tj
- Free Economic Zone Panj — fez.tj
- Free Economic Zone Ishkoshim — fez.tj
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice