Where we work · Togo
ISO and GRC certification consulting in Togo
Achieve ISO and GRC certification in Togo with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in Togo
- Cocoa, coffee, cotton, cashew and soya exporters and agro-processors
- Manufacturers in the industrial platform and the free-zone regime
- Port, transit, logistics and warehousing operators
- Banks, payment firms and other financial service providers
- Operators of essential services in energy, health, transport and water
- Telecoms, software and outsourced-service companies
Clients include
ISO and GRC certification in Togo at a glance
Quality, security and privacy rules in Togo come from a short list of named institutions. Loi n° 2019-014 creates the IPDCP as the data protection authority, while the ANCy, created by the 2018 cybersecurity law, sets rules for operators of essential services and cites ISO/IEC 27001 and PCI DSS among the references of its 2022 cybersecurity rules. The HAUQE coordinates the national quality infrastructure, with the ATN for standards, the ATOMET for metrology and the COTAG for approval. Accreditation for laboratories is regional through SOAC, so management-system certificates usually carry accreditation from another economy. The Ministry of Commerce's exporter guide names cocoa, coffee and cotton as the main agricultural exports, the Port Autonome de Lomé appears in the essential-services annex, and the Plateforme Industrielle d'Adétikopé and the free-zone regime run by the API-ZF draw manufacturers. Sterling's Casablanca office supports Togolese organisations, backed by 8,100+ client engagements in 60+ countries and 20+ years of practice, with Effivity and Sterling Academy included in the engagement.
ISO and GRC standards Sterling delivers in Togo
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Togo (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel Instance de protection des données à caractère personnel (IPDCP), which the law creates as an independent administrative authority to see that processing follows the law, inform controllers and individuals of their rights and duties, receive prior formalities, complaints and petitions, carry out checks, give opinions, authorise cross-border transfers, keep a public register of processing and report each year to the highest institutions of the State | Covers the collection, processing, transmission, storage and use of personal data by individuals, the State, local authorities and public or private legal persons, including processing by a controller on Togolese territory or using means located in Togo other than for transit. Most processing is declared and the controller may start only once the authority has issued its receipt; processing of genetic and health-research data, offence data, file interconnection, national identification numbers, biometric data and certain public-interest purposes needs the authority's authorisation, and State processing follows a reasoned opinion. A controller that appoints a data protection correspondent, notified to the authority, is exempt from the declaration unless a transfer to a third country is planned. Data must be collected lawfully and fairly for specified purposes, kept accurate and no longer than needed, and secured; racial, ethnic, religious, philosophical, political, union, sex-life, health and offence-related data are barred unless an exception applies. People have rights to information, access, objection, correction, deletion and erasure. Transfers to a third country require sufficient protection there, with the authority informed beforehand and giving a reasoned opinion, subject to listed exceptions. | |
| Loi n° 2018-026 du 07 décembre 2018 sur la cybersécurité et la lutte contre la cybercriminalité, as modified by Loi n° 2022-009 Agence Nationale de la Cybersécurité (ANCy), which describes itself as the national authority for information-system security in Togo, under the Prime Minister with technical and administrative supervision by the ministers in charge of the digital economy and of security | Frames cybersecurity policy, the designation of operators of essential services and the qualification of trust-service providers and security products. It sits beside the personal data law rather than replacing it. | |
| Agence Nationale de la Cybersécurité (ANCy) Cybersecurity of information systems, operators of essential services and trust-service providers | Décret n° 2019-095/PR du 8 juillet 2019 relatif aux opérateurs de services essentiels, aux infrastructures essentielles et aux obligations y afférentes lists the essential services (public administration, energy, air transport, payment services of banks, health and pharmaceutical distribution, drinking water and Port Autonome de Lomé systems among them) and obliges designated operators to follow the cybersecurity rules; Arrêté n° 2022-040/PMRT du 29 juin 2022 adopts those rules, which require the operator's security officer to have training of at least ISO/IEC 27001 or equivalent and list ISO/IEC 27001:2013 and PCI DSS among their references; the ANCy also publishes requirement frameworks for qualified security-audit, incident-detection and incident-response providers. | ISO/IEC 27001, PCI DSS |
| Ministry in charge of agriculture, fisheries and animal resources, with the ministry in charge of commerce and quality control and the Ministry of Health's Institut National d'Hygiène for food analysis Food, plant, animal and fishery products, including export controls | The agriculture ministry's own page says its minister defines and applies policy on animal health and on promoting the quality of agricultural and food products, exercises the sanitary police and ensures the quality of fishery and fish-farming products. The Ministry of Commerce's exporter guide (July 2024) names the competent services for each export document: the plant protection directorate for phytosanitary certificates, the livestock directorate for sanitary certificates on foods of animal origin, the Institut National d'Hygiène for microbiological analysis results and the product conditioning directorate of the commerce ministry for quality certificates, and lists the farm products the conditioning directorate regularly controls. | |
| Agence nationale de régulation du médicament et autres produits de santé, whose creating decree the Council of Ministers adopted on 7 September 2026 Medicines and other health products | The Council's communiqué describes an autonomous national agency for the regulation, supervision and surveillance of medicines and other health products, strengthening market surveillance, pharmaceutical inspection, vigilance and quality control of health products. | |
| Banque Centrale des Etats de l'Afrique de l'Ouest (BCEAO), which lists Togo on its member-state pages Banks, electronic money issuers and payment systems in the West African Economic and Monetary Union | The BCEAO publishes the Union's payment-system regulation, including Règlement n°15/2002/CM/UEMOA relatif aux systèmes de paiement dans les Etats membres de l'UEMOA. Banks' payment services are also one of the essential services in Togo's operators-of-essential-services decree. | |
| Ministry in charge of labour and the labour inspectorate, under the Labour Code Occupational health and safety | Loi n° 2021-012 du 18 juin 2021 portant code du travail requires every enterprise to observe adequate hygiene, safety and health measures including risk prevention, information and training, and respect for environmental norms; to provide a safety and health service for its workers; to set up a safety and health committee where it employs at least twenty-five workers (a safety delegate elsewhere); and it gives workers the right to alert and to withdraw from a serious and imminent danger. | |
| Autorité de Réglementation du Secteur de l'Electricité (ARSE) Electricity and drinking-water services | The authority says it regulates the electricity sub-sector under Loi 2000-012 du 18 juillet 2000 and Loi n°2018-010 du 08 août 2018 on renewable electricity production, together with the drinking-water and collective sanitation sub-sector. | |
| Haute Autorité de la Qualité et de l'Environnement (HAUQE), a public establishment under the Prime Minister that coordinates the national quality infrastructure Quality infrastructure: standards, approval and metrology | The HAUQE site says the framework law on quality of 12 August 2009 created it and its technical structures and that the decree of 24 December 2015 sets their attributions. The Agence Togolaise de Normalisation (ATN) defines and promotes national standards and appears on the ISO site as Togo's member body; the Agence Togolaise de Métrologie (ATOMET) manages metrology and keeps a national calibration laboratory; the Comité Togolais d'Agrément (COTAG) is the national approval structure. The ministry in charge of agriculture reported in August 2026 that the ATN has produced 46 national standards for priority food chains. | |
| Haute autorité de prévention et de lutte contre la corruption et les infractions assimilées (HAPLUCIA) Anti-corruption | The official gazette portal lists Loi 2015-006 of 28 July 2015 portant création de la haute autorité de prévention et de lutte contre la corruption et les infractions assimilées. |
Accreditation and recognition
- West African Accreditation System (SOAC / Système Ouest Africain d'Accréditation): Regional accreditation body serving Togo among nine ECOWAS member states, according to UNIDO.
- Comité Togolais d'Agrément (COTAG): National approval (agrément) structure under the HAUQE.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement code and the public procurement regulatory authority (Décret n° 2022-080/PR du 06 juillet 2022 portant code des marchés publics; Autorité de régulation de la commande publique (ARCOP), set up by Décret n° 2022-063/PR du 11 mai 2022 and attached to the Presidency of the Republic): The code says the contracting authority fixes the standards, technical approvals or specifications that goods, works and services must meet, taken from those approved by the national quality body or used in Togo, and may refer to international standards such as those of ISO where no national or community standard exists; the rules cover the certification of products and services. A contracting authority may ask bidders for a qualification certificate issued by an official body, but not exclusively or in a discriminatory way. No management-system certificate is required by the code itself, so a notice matters only where it asks for one.
Economic zones
- Plateforme Industrielle d'Adétikopé (PIA): agro-processing, textile and garment manufacturing, cold storage and finished-product storage, inland container depot, solar
- Zone franche industrielle regime and the investment code: export-oriented manufacturing, agro-industry, services under the free-zone status
- Port Autonome de Lomé: transit and re-export, container handling, logistics and warehousing
Sterling in Togo
Sterling delivers in Togo from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Togo clients ask
Does Togo have a personal data protection law, and who oversees it?
Yes. Law No. 2019-014 of 29 October 2019 regulates the collection, processing, transmission, storage and use of personal data and creates the IPDCP, an independent administrative authority that receives declarations, complaints and authorisation requests, carries out checks and can impose sanctions. The ANCy publishes the text on its regulations page. Confirm which formalities apply to your processing with Togolese counsel or the IPDCP.
Which body accredits conformity assessment in Togo?
Two layers exist. Regionally, UNIDO lists Togo among the nine states served by SOAC, whose 2022 recognitions through AFRAC and ILAC cover testing, calibration and medical laboratories. Nationally, the HAUQE site presents the COTAG as the approval structure that sets criteria and supervises approved bodies. For a management-system certificate, ask the certification body to show its own accreditation and scope.
In which language are audits and documents handled in Togo?
French, in practice. The data protection law, the official gazette, ministry portals and the cybersecurity rules are published in French, so expect document review, contracts and most interviews in it. The ANCy does publish its national cybersecurity strategy in English. Settle the audit language, any interpreter and the language of controlled documents with the certification body when you apply.
Do Togo's cybersecurity rules require ISO 27001?
Not as a certificate. The 2022 rules bind operators of essential services designated by the ANCy, and they ask that the security officer's training plan include at least ISO/IEC 27001 training or an equivalent. ISO/IEC 27001:2013 and PCI DSS appear among the references on which the rules rest. Whether your organisation is a designated operator is for the ANCy to say.
What controls apply when exporting farm products from Togo?
The Ministry of Commerce's exporter guide of July 2024 sets out the documents by product: certificates of origin, phytosanitary certificates from the plant protection directorate, sanitary certificates from the veterinary services for foods of animal origin, and quality certificates for agricultural products. It names cocoa, coffee and cotton as the main agricultural exports. Confirm the document set for your product with the competent directorate before shipping.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel — ancy.gouv.tg (accessed 18 Oct 2026)
- Loi n° 2018-026 du 07 décembre 2018 sur la cybersécurité et la lutte contre la cybercriminalité, as modified by Loi n° 2022-009 — ancy.gouv.tg (accessed 18 Oct 2026)
- Décret n° 2019-095/PR du 8 juillet 2019 relatif aux opérateurs de services essentiels, aux infrastructures essentielles et aux obligations y afférentes lists the essential services (public administration, energy, air transport, payment services of banks, health and pharmaceutical distribution, drinking water and Port Autonome de Lomé systems among them) and obliges designated operators to follow the cybersecurity rules; Arrêté n° 2022-040/PMRT du 29 juin 2022 adopts those rules, which require the operator's security officer to have training of at least ISO/IEC 27001 or equivalent and list ISO/IEC 27001:2013 and PCI DSS among their references; the ANCy also publishes requirement frameworks for qualified security-audit, incident-detection and incident-response providers. — ancy.gouv.tg (accessed 18 Oct 2026)
- The agriculture ministry's own page says its minister defines and applies policy on animal health and on promoting the quality of agricultural and food products, exercises the sanitary police and ensures the quality of fishery and fish-farming products. The Ministry of Commerce's exporter guide (July 2024) names the competent services for each export document: the plant protection directorate for phytosanitary certificates, the livestock directorate for sanitary certificates on foods of animal origin, the Institut National d'Hygiène for microbiological analysis results and the product conditioning directorate of the commerce ministry for quality certificates, and lists the farm products the conditioning directorate regularly controls. — agriculture.gouv.tg; commerce.gouv.tg (accessed 18 Oct 2026)
- The Council's communiqué describes an autonomous national agency for the regulation, supervision and surveillance of medicines and other health products, strengthening market surveillance, pharmaceutical inspection, vigilance and quality control of health products. — presidenceduconseil.gouv.tg (accessed 18 Oct 2026)
- The BCEAO publishes the Union's payment-system regulation, including Règlement n°15/2002/CM/UEMOA relatif aux systèmes de paiement dans les Etats membres de l'UEMOA. Banks' payment services are also one of the essential services in Togo's operators-of-essential-services decree. — bceao.int (accessed 18 Oct 2026)
- Loi n° 2021-012 du 18 juin 2021 portant code du travail requires every enterprise to observe adequate hygiene, safety and health measures including risk prevention, information and training, and respect for environmental norms; to provide a safety and health service for its workers; to set up a safety and health committee where it employs at least twenty-five workers (a safety delegate elsewhere); and it gives workers the right to alert and to withdraw from a serious and imminent danger. — jo.gouv.tg (accessed 18 Oct 2026)
- The authority says it regulates the electricity sub-sector under Loi 2000-012 du 18 juillet 2000 and Loi n°2018-010 du 08 août 2018 on renewable electricity production, together with the drinking-water and collective sanitation sub-sector. — arse.tg (accessed 18 Oct 2026)
- The HAUQE site says the framework law on quality of 12 August 2009 created it and its technical structures and that the decree of 24 December 2015 sets their attributions. The Agence Togolaise de Normalisation (ATN) defines and promotes national standards and appears on the ISO site as Togo's member body; the Agence Togolaise de Métrologie (ATOMET) manages metrology and keeps a national calibration laboratory; the Comité Togolais d'Agrément (COTAG) is the national approval structure. The ministry in charge of agriculture reported in August 2026 that the ATN has produced 46 national standards for priority food chains. — hauqe.tg; committee.iso.org; agriculture.gouv.tg (accessed 18 Oct 2026)
- The official gazette portal lists Loi 2015-006 of 28 July 2015 portant création de la haute autorité de prévention et de lutte contre la corruption et les infractions assimilées. — jo.gouv.tg (accessed 18 Oct 2026)
- West African Accreditation System (SOAC / Système Ouest Africain d'Accréditation) — hub.unido.org; ilac.org; wacomp.ecowas.int (accessed 18 Oct 2026)
- Comité Togolais d'Agrément (COTAG) — hauqe.tg (accessed 18 Oct 2026)
- Public procurement code and the public procurement regulatory authority — jo.gouv.tg (accessed 18 Oct 2026)
- Plateforme Industrielle d'Adétikopé (PIA) — pia-togo.com (accessed 18 Oct 2026)
- Zone franche industrielle regime and the investment code — investirautogo.tg; investissement.gouv.tg (accessed 18 Oct 2026)
- Port Autonome de Lomé — ancy.gouv.tg; maritime.gouv.tg; commerce.gouv.tg (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice