Where we work · Tanzania
ISO and GRC certification consulting in Tanzania
Achieve ISO and GRC certification in Tanzania with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Nairobi office team
- Effivity and Academy included
Sectors that ask for certification in Tanzania
Clients include
ISO and GRC certification in Tanzania at a glance
Tanzania's quality infrastructure has a regional shape: there is no national accreditation body, so the Southern African Development Community Accreditation Service (SADCAS) accredits certification bodies and laboratories, while the Tanzania Bureau of Standards sets national standards, controls product quality and certifies and registers food, food products and cosmetics. Privacy became a compliance subject when the Personal Data Protection Act, 2022 came into force on 1 May 2023, with the Personal Data Protection Commission registering controllers and processors and issuing permits for transfers abroad. The Bank of Tanzania has published draft cybersecurity guidelines for financial service providers, and the Tanzania Medicines and Medical Devices Authority expects ISO 13485 from device manufacturing sites. Demand comes from food processors and exporters, manufacturers in the special economic zones run by TISEZA, banks and payment providers, mining, energy and construction contractors, tourism operators and public-sector suppliers bidding through NeST. Certification is granted by accredited certification bodies. Sterling's Nairobi office supports clients in Tanzania, drawing on 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Tanzania
Each page covers who needs the standard in Tanzania, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Tanzania (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Data Protection Act, 2022 Personal Data Protection Commission (PDPC), established under section 6 of the Act | Applies to Mainland Tanzania and to Tanzania Zanzibar except non-union matters. Covers manual and automated processing by controllers domiciled in the United Republic and by controllers or processors outside it whose processing takes place in the United Republic, other than mere transit. No one may collect or process personal data without registering with the Commission; public institutions are deemed registered. The PDPC states the Act was enacted in November 2022, received assent in December 2022 and came into force on 1 May 2023, when the Commission was established. | |
| Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 Personal Data Protection Commission (PDPC) | Registration procedure, data subject rights procedures, applications for permission to transfer personal data out of the country, obligations and security standards for controllers and processors, protection by design or by default, appointment and duties of the data protection officer, and data protection impact assessment. | |
| Personal Data Protection (Complaints Settlement Procedures) Regulations, 2023 Personal Data Protection Commission (PDPC) | How complaints about personal data protection are lodged with and handled by the Commission. | |
| PDPC registration and cross-border transfer permit services Personal Data Protection Commission (PDPC) | The PDPC states that registration is done online, that private organisations attach their BRELA certificate, TIN certificate and audited financial report, and that a data protection officer is introduced by letter and completes the registration. It also states that it issues permits to entities intending to transfer personal data outside the country and assesses protection in the destination country. | |
| Bank of Tanzania (BoT) Banks and payment service providers | Draft Cybersecurity Guidelines for Financial Service Providers, 2026 (March 2026), published for comment and issued under section 71 of the Banking and Financial Institutions Act, 2006; financial service providers are institutions licensed under that Act and the National Payment Systems Act, 2015. The draft sets board and senior management duties, a Chief Information Security Officer, third-party and outsourcing risk, incident reporting to the Bank and penetration testing by an independent firm licensed by TCRA; it names no ISO standard. | |
| Tanzania Medicines and Medical Devices Authority (TMDA) Medical devices and diagnostics manufacturers | Guidelines on Submission of Documentation for Quality Audit of Medical Devices and Diagnostics Manufacturing Sites (June 2023), made under section 51(c) of the Tanzania Medicines and Medical Devices Act, Cap. 219. Manufacturing sites are to meet the quality management system requirements of the current ISO 13485 standard and the TMDA Control of Medical Devices Regulations; a certified copy of an ISO 13485 certificate of compliance is among the documents listed. | ISO 13485 |
| Tanzania Bureau of Standards (TBS) Products, food and cosmetics; national standards | Standards Act, Cap. 130. TBS is the national standards body; its functions include quality control of commodities and services, standards marks, inspection and registration of premises, certifying and registering food, food products and cosmetics, and pre-shipment verification of conformity. Compulsory standards are declared by the Minister for products affecting health, safety, the environment or the economy. | HACCP, ISO 22000, ISO 9001 |
| Occupational Safety and Health Authority (OSHA) Workplace safety and health | Occupational Health and Safety Act, 2003, the National Occupational Health and Safety Policy, 2010 and regulations made under the Act, which OSHA states guide its operations. | |
| National Environment Management Council (NEMC) Environment | Environmental Management Act No. 20 of 2004. NEMC states that it enforces compliance with the Act, oversees environmental impact assessment and environmental audit, and conducts environmental research and awareness. | |
| Tanzania Civil Aviation Authority (TCAA) Civil aviation | Civil Aviation Act, Cap. 80 and Civil Aviation Regulations; TCAA lists airworthiness certification, aircraft registration and Approved Maintenance Organisation approval among its functions. | |
| Energy and Water Utilities Regulatory Authority (EWURA) Energy and water utilities | Regulates electricity, petroleum, natural gas and water and sanitation through licensing, compliance monitoring and tariffs, as its site describes. |
Accreditation and recognition
- Southern African Development Community Accreditation Service (SADCAS): Multi-economy accreditation body serving SADC Member States without a national accreditation body; SADCAS lists Tanzania among the countries it serves, and its national accreditation focal points for Tanzania sit at TBS.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public Procurement Act, 2023 (Act No. 10 of 2023), Cap. 410, and the Public Procurement Regulatory Authority (PPRA) (Public Procurement Regulatory Authority (PPRA)): PPRA monitors and enforces compliance with the Public Procurement Act, Cap. 410 and runs the National e-Procurement System of Tanzania (NeST), through which bidders register and tenders are conducted. Qualification evidence is set in each tender document; the Act does not make an ISO certificate a general requirement.
Economic zones
- Special economic zones under the Investment and Special Economic Zones Act, 2025 (Tanzania Investment and Special Economic Zones Authority, TISEZA): manufacturing, agriculture and agro-processing, pharmaceuticals, energy, mining, tourism
Sterling in Tanzania
Sterling delivers in Tanzania from its Nairobi office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Tanzania, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Tanzanian clients ask
Who accredits certification bodies for Tanzania?
SADCAS does. Tanzania has no national accreditation body, so the Southern African Development Community Accreditation Service serves it, with focal points at TBS. Its international recognition covers ISO 9001, ISO 14001, ISO 45001 and ISO 22000 certification and product certification. For other standards, certificates often carry accreditation from another economy, so ask the certification body for its accreditation scope.
Is there a data protection law in Tanzania?
Yes. The Personal Data Protection Act, 2022 (Act No. 11 of 2022, Cap. 44) came into force on 1 May 2023 and is enforced by the Personal Data Protection Commission. Regulations made in 2023 set the registration procedure, transfer applications, security duties and impact assessments. Test how they apply to your organisation with your counsel or the Commission.
Does Tanzanian public procurement require ISO certification?
Not as a blanket rule. The Public Procurement Act, 2023 sets the framework, PPRA enforces it and tenders run through the NeST electronic system, while each tender document sets its own qualification evidence. A certificate helps only where the tender asks for it, so read the qualification clause and ask the procuring entity if it is unclear.
Which regulator expects ISO 13485 from medical device manufacturers?
The Tanzania Medicines and Medical Devices Authority. Its June 2023 guidelines for quality audit of medical device and diagnostics manufacturing sites expect compliance with the current ISO 13485 standard and the TMDA device regulations, and list a certified copy of an ISO 13485 certificate among the supporting documents. Check the current guideline with TMDA before you file.
Which law now governs Tanzania's special economic zones?
The Investment and Special Economic Zones Act, 2025. It repealed the earlier investment, export processing zones and special economic zones Acts and created TISEZA, which runs a one-stop facilitation centre and features zones such as Benjamin William Mkapa, Kwala and Bagamoyo. Confirm incentives and conditions for your project with TISEZA or your adviser.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Act, 2022 — pdpc.go.tz (accessed 12 Oct 2026)
- Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 — pdpc.go.tz (accessed 12 Oct 2026)
- Personal Data Protection (Complaints Settlement Procedures) Regulations, 2023 — pdpc.go.tz (accessed 12 Oct 2026)
- PDPC registration and cross-border transfer permit services — pdpc.go.tz (accessed 12 Oct 2026)
- Draft Cybersecurity Guidelines for Financial Service Providers, 2026 (March 2026), published for comment and issued under section 71 of the Banking and Financial Institutions Act, 2006; financial service providers are institutions licensed under that Act and the National Payment Systems Act, 2015. The draft sets board and senior management duties, a Chief Information Security Officer, third-party and outsourcing risk, incident reporting to the Bank and penetration testing by an independent firm licensed by TCRA; it names no ISO standard. — bot.go.tz (accessed 12 Oct 2026)
- Guidelines on Submission of Documentation for Quality Audit of Medical Devices and Diagnostics Manufacturing Sites (June 2023), made under section 51(c) of the Tanzania Medicines and Medical Devices Act, Cap. 219. Manufacturing sites are to meet the quality management system requirements of the current ISO 13485 standard and the TMDA Control of Medical Devices Regulations; a certified copy of an ISO 13485 certificate of compliance is among the documents listed. — tmda.go.tz (accessed 12 Oct 2026)
- Standards Act, Cap. 130. TBS is the national standards body; its functions include quality control of commodities and services, standards marks, inspection and registration of premises, certifying and registering food, food products and cosmetics, and pre-shipment verification of conformity. Compulsory standards are declared by the Minister for products affecting health, safety, the environment or the economy. — tbs.go.tz (accessed 12 Oct 2026)
- Occupational Health and Safety Act, 2003, the National Occupational Health and Safety Policy, 2010 and regulations made under the Act, which OSHA states guide its operations. — osha.go.tz (accessed 12 Oct 2026)
- Environmental Management Act No. 20 of 2004. NEMC states that it enforces compliance with the Act, oversees environmental impact assessment and environmental audit, and conducts environmental research and awareness. — nemc.or.tz (accessed 12 Oct 2026)
- Civil Aviation Act, Cap. 80 and Civil Aviation Regulations; TCAA lists airworthiness certification, aircraft registration and Approved Maintenance Organisation approval among its functions. — tcaa.go.tz (accessed 12 Oct 2026)
- Regulates electricity, petroleum, natural gas and water and sanitation through licensing, compliance monitoring and tariffs, as its site describes. — ewura.go.tz (accessed 12 Oct 2026)
- Southern African Development Community Accreditation Service (SADCAS) — sadcas.org; iaf.nu (accessed 12 Oct 2026)
- Public Procurement Act, 2023 (Act No. 10 of 2023), Cap. 410, and the Public Procurement Regulatory Authority (PPRA) — ppra.go.tz (accessed 12 Oct 2026)
- Special economic zones under the Investment and Special Economic Zones Act, 2025 (Tanzania Investment and Special Economic Zones Authority, TISEZA) — tiseza.go.tz (accessed 12 Oct 2026)
Talk to a consultant
Plan your certification with the Nairobi team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Nairobi office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice