Where we work · Tunisia
ISO and GRC certification consulting in Tunisia
Achieve ISO and GRC certification in Tunisia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in Tunisia
Clients include
ISO and GRC certification in Tunisia at a glance
Tunisia's buyers and authorities decide which certificates carry weight. Personal data falls under Organic Law No. 2004-63, supervised by the INPDP, which takes declarations and authorises sensitive processing and transfers abroad. The ANCS runs mandatory security audits for listed categories and labels cloud hosting providers, while the Ministry of Public Health, ANCSEP and the agriculture ministry share food control. ANME backs ISO 50001 in industry and the ISST handles workplace safety. Accreditation sits with TUNAC, which Global ACI lists as a Full Member and signatory, and INNORPI is the standards body. Demand comes from automotive and mechanical-electrical suppliers, aerospace, agri-food, textiles, pharmaceuticals, digital services and renewable energy, and an industrial upgrading programme lists quality system assistance. Certificates come from accredited certification bodies, never from Sterling. From its Casablanca office Sterling supports Tunisian clients, travelling to sites when required and working remotely for the rest; it brings 20+ years and 8,100+ client engagements in 60+ countries, and every engagement carries Effivity and Sterling Academy.
ISO and GRC standards Sterling delivers in Tunisia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Tunisia (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Organic Law No. 2004-63 on the protection of personal data Instance Nationale de Protection des Données à Caractère Personnel (INPDP), the National Authority for the Protection of Personal Data, which the law itself establishes | Applies to automated and non-automated processing of personal data by individuals and legal persons, apart from purely personal or family use. Every processing is declared in advance to the INPDP, and the law requires the INPDP's authorisation for listed cases, including sensitive data, video surveillance and any transfer of data abroad (Articles 7, 8, 15, 52 and 69). Data is collected for lawful, specified and explicit purposes, kept accurate, and processed with the person's express consent unless an exception applies. People must be informed in advance and have rights of access, correction and objection, and the INPDP hears disputes on them. Controllers must take the precautions needed to secure data, and a processor must be chosen with care and act within the controller's limits (Articles 18 to 20). Transfers abroad are allowed only to a country ensuring an adequate level of protection. Article 22 also sets conditions of Tunisian nationality and residence on individuals or legal representatives who process data, so foreign organisations should take local advice. The law does not cite an ISO standard, and its penalties are set in Chapter VII and not restated here. | |
| Decrees No. 2007-3003 and No. 2007-3004 of 27 November 2007, and Organic Law No. 2017-42 INPDP | Read the 2007 decrees with the law for the practical declaration and authorisation procedure. The compendium also reproduces INPDP decisions, among them one determining the countries it treats as giving adequate protection, one on health data and one on the conditions for installing video surveillance. | |
| Agence Nationale de la Cybersécurité (ANCS), the National Cybersecurity Agency Public bodies, telecommunications and internet providers, firms with interconnected networks, hosting and cloud providers, firms processing users' personal data over telecom networks, and vital digital infrastructure | The ANCS states that security audits of information systems are governed by Decree-Law No. 2023-17 of 11 March 2023 and organised by an order of 1 October 2019 fixing the specification for security audit activity. The audit duty covers the listed categories, and only auditors certified by the ANCS may perform the missions. Its audit reference and reporting model set the control criteria. Circular No. 24 of 5 November 2020 asks public establishments to set up a steering committee, an operational security cell and an information security officer. The ANCS also grants the G-Cloud and N-Cloud labels to hosting providers and requires organisations covered by the decree-law to host government systems with labelled providers. Its audit pages present ISO/IEC 27001, 27004 and 27005 as reference norms for information security audits. | ISO/IEC 27001 |
| Ministry of Public Health (Directorate of Environmental Hygiene and Environmental Protection), with the National Agency for Sanitary and Environmental Control of Products (ANCSEP) coordinating controllers, and the ministries of agriculture and of industry and trade Food businesses, food exporters and food laboratories | FAO's Codex contact-point entry for Tunisia lists these competent authorities. It says the Health Ministry directorate carries out official food control at all stages from production to consumption through regional hygiene services and laboratories, and builds the skills of sanitary controllers in food risk management, including ISO 22000 and HACCP. The agriculture side covers veterinary and plant-product controls, and the industry side covers food-industry standards and plant approval. The entry is supplied by Tunisia and does not date its ministry names, so check the current competent authority for your product. | ISO 22000, HACCP |
| Banque Centrale de Tunisie (BCT), the Central Bank of Tunisia Banks and financial institutions | The BCT supervises banks and publishes its banking regulation, circulars and an annual report on banking supervision (the 2024 edition is listed on its site). Its exchange-regulation page states that foreign investment is free at creation and extension, with prior authorisation for projects in certain sectors. The pages do not name an ISO standard. | |
| Institut de Santé et de Sécurité au Travail (ISST), the Occupational Health and Safety Institute Industrial employers and workplace health and safety | The ISST was created by Law No. 90-77 of 7 August 1990, and its site lists the national health and safety texts, among them Law No. 94-28 of 21 February 1994 on compensation for work accidents and occupational diseases. It offers firms a regulatory health and safety audit and support with health and safety management systems. Its pages do not name ISO 45001. | |
| Agence Nationale pour la Maîtrise de l'Energie (ANME), the National Agency for Energy Management Energy-intensive industry and the industrial energy transition | ANME's legal-texts page lists Law No. 72 of 2004 on energy management, as amended by Law No. 7 of 2009, and a decree-law of 2022 amending it. ANME's industry page says it supports firms with energy audits and helps them obtain energy management system certification to ISO 50001. | ISO 50001 |
| Ministry of the Environment, which links the National Environmental Protection Agency (ANPE) Industrial waste and environmental protection | The Ministry's portal links ANPE's file-tracking service and publishes the list of companies authorised to handle hazardous and non-hazardous waste, beside a page of environmental legislation. It does not name ISO 14001. |
Accreditation and recognition
- TUNAC (Conseil National d'Accréditation, Tunisian Accreditation Council): National accreditation body — a public establishment under the ministry in charge of industry, run under the 2005 amendment of the national accreditation system law (Law No. 2005-92 of 3 October 2005) and two 2006 decrees, with accreditation sections for certification, testing and calibration, analysis and inspection.
- INNORPI (Institut National de la Normalisation et de la Propriété Industrielle): National standards body — established under Law No. 2009-38 of 30 June 2009 and placed under the ministry in charge of industry; it draws up the national standards programme, sets up technical standardisation committees, acts as the national information point on standards and represents Tunisia at ISO and IEC. It is cited here for its standards role only.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement (the national public procurement portal and the procurement decree) (Haute Instance de la Commande Publique (HAICOP), under the Presidency of the Government): HAICOP runs the national portal on which buyers publish plans, tenders and results, and keeps an exclusion list of firms barred from public contracts. Its legislation page lists Decree No. 2014-1039 of 13 March 2014 regulating public procurement, amended by Government Decree No. 2018-416 of 11 May 2018. Which certificates a tender requires is set in each tender document, so read the evaluation criteria before bidding.
- Industrial upgrading programme (programme de mise à niveau, PMN) (Ministry in charge of industry, through its upgrading office): The industry portal describes the programme as a way to improve competitiveness and exports. Among supported actions it lists technical assistance such as quality management systems and ISO, BRC and IFS work, besides equipment, software and training. Eligibility and any grant are set by the programme, so check the current rules with the upgrading office.
- Labels for hosting providers (G-Cloud and N-Cloud) (Agence Nationale de la Cybersécurité (ANCS)): The ANCS grants, renews each year and withdraws the labels after an audit against its reference criteria, and publishes the list of labelled providers. Organisations covered by the decree-law must host government systems and services with labelled providers.
Economic zones
- Elgazala Technopark: information and communication technology, medical devices, e-health
- Bizerte agro-food competitiveness cluster (AGRO'TECH technopole): agri-food
- Novation City, Sousse: mechatronics, information technology, electronics
- Technopole of Sfax: information and communication technology, multimedia
- Industrial zones managed with the Industrial Land Agency (AFI):
Sterling in Tunisia
Sterling delivers in Tunisia from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Tunisia clients ask
Is there a personal data protection law in Tunisia, and who supervises it?
Yes. Organic Law No. 2004-63 of 27 July 2004 governs the processing of personal data, and it creates the INPDP, the national data protection authority. Processing is declared to the INPDP in advance, and listed cases, such as sensitive data, video surveillance and transfers abroad, need its authorisation. Confirm what your own processing triggers with the INPDP or Tunisian counsel.
Does Tunisia's accreditation council hold international recognition?
According to Global ACI, TUNAC is a Full Member and a signatory of the Global ACI mutual recognition arrangement. Its own site also lists EA MLA scopes and, under the ILAC and Global ACI arrangements, recognition covering ISO 9001, ISO 14001, ISO 22000, ISO 45001 and ISO/IEC 27001. Ask any certification body for its accreditation certificate and scope, and check what your customer accepts.
Do Tunisian companies have to commission security audits of their information systems?
Some do. The ANCS says the audit duty under Decree-Law No. 2023-17 covers public bodies, telecom and internet providers, firms with interconnected networks, hosting and cloud providers, firms processing users' personal data over telecom networks, and vital digital infrastructure. Only auditors certified by the ANCS may perform these audits. Check with the ANCS or counsel whether you are in scope.
Can an industrial company in Tunisia get support for quality system work?
The industrial upgrading programme run through the ministry in charge of industry lists technical assistance such as quality management systems and ISO, BRC and IFS work among supported actions. Whether your firm qualifies, and what any support covers, is decided by the programme. Contact the upgrading office for the rules before planning a project around it.
What are the working week and time zone in Tunisia?
Public bodies work Monday to Friday and the weekend is Saturday and Sunday. Tunisia uses UTC+1 all year. Public offices shorten their day in summer and in Ramadan, and the religious holidays move with the lunar calendar. Fix audit dates with the site and the certification body well ahead, allowing for those periods.
Can audits in Tunisia be conducted in French or English?
Often, since official bodies publish in French and Arabic and companies commonly keep technical documents in French, while English is used in investment promotion. Shop-floor interviews may run in Arabic. At application, settle with the certification body which language the audit, any interpreter and your controlled documents will use.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Organic Law No. 2004-63 on the protection of personal data — ins.tn; mjs.tn; marchespublics.gov.tn; ancs.tn (accessed 18 Oct 2026)
- Decrees No. 2007-3003 and No. 2007-3004 of 27 November 2007, and Organic Law No. 2017-42 — mjs.tn (accessed 18 Oct 2026)
- The ANCS states that security audits of information systems are governed by Decree-Law No. 2023-17 of 11 March 2023 and organised by an order of 1 October 2019 fixing the specification for security audit activity. The audit duty covers the listed categories, and only auditors certified by the ANCS may perform the missions. Its audit reference and reporting model set the control criteria. Circular No. 24 of 5 November 2020 asks public establishments to set up a steering committee, an operational security cell and an information security officer. The ANCS also grants the G-Cloud and N-Cloud labels to hosting providers and requires organisations covered by the decree-law to host government systems with labelled providers. Its audit pages present ISO/IEC 27001, 27004 and 27005 as reference norms for information security audits. — ancs.tn (accessed 18 Oct 2026)
- FAO's Codex contact-point entry for Tunisia lists these competent authorities. It says the Health Ministry directorate carries out official food control at all stages from production to consumption through regional hygiene services and laboratories, and builds the skills of sanitary controllers in food risk management, including ISO 22000 and HACCP. The agriculture side covers veterinary and plant-product controls, and the industry side covers food-industry standards and plant approval. The entry is supplied by Tunisia and does not date its ministry names, so check the current competent authority for your product. — fao.org (accessed 18 Oct 2026)
- The BCT supervises banks and publishes its banking regulation, circulars and an annual report on banking supervision (the 2024 edition is listed on its site). Its exchange-regulation page states that foreign investment is free at creation and extension, with prior authorisation for projects in certain sectors. The pages do not name an ISO standard. — bct.gov.tn (accessed 18 Oct 2026)
- The ISST was created by Law No. 90-77 of 7 August 1990, and its site lists the national health and safety texts, among them Law No. 94-28 of 21 February 1994 on compensation for work accidents and occupational diseases. It offers firms a regulatory health and safety audit and support with health and safety management systems. Its pages do not name ISO 45001. — isst.nat.tn (accessed 18 Oct 2026)
- ANME's legal-texts page lists Law No. 72 of 2004 on energy management, as amended by Law No. 7 of 2009, and a decree-law of 2022 amending it. ANME's industry page says it supports firms with energy audits and helps them obtain energy management system certification to ISO 50001. — anme.tn (accessed 18 Oct 2026)
- The Ministry's portal links ANPE's file-tracking service and publishes the list of companies authorised to handle hazardous and non-hazardous waste, beside a page of environmental legislation. It does not name ISO 14001. — environnement.gov.tn (accessed 18 Oct 2026)
- TUNAC (Conseil National d'Accréditation, Tunisian Accreditation Council) — tunac.tn; global-aci.org (accessed 18 Oct 2026)
- INNORPI (Institut National de la Normalisation et de la Propriété Industrielle) — innorpi.tn (accessed 18 Oct 2026)
- Public procurement (the national public procurement portal and the procurement decree) — marchespublics.gov.tn (accessed 18 Oct 2026)
- Industrial upgrading programme (programme de mise à niveau, PMN) — tunisieindustrie.nat.tn (accessed 18 Oct 2026)
- Labels for hosting providers (G-Cloud and N-Cloud) — ancs.tn (accessed 18 Oct 2026)
- Elgazala Technopark — tia.gov.tn
- Bizerte agro-food competitiveness cluster (AGRO'TECH technopole) — tia.gov.tn
- Novation City, Sousse — tia.gov.tn
- Technopole of Sfax — tia.gov.tn
- Industrial zones managed with the Industrial Land Agency (AFI) — tia.gov.tn
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice