Where we work · Uganda
ISO and GRC certification consulting in Uganda
Achieve ISO and GRC certification in Uganda with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Nairobi office team
- Effivity and Academy included
Sectors that ask for certification in Uganda
Clients include
ISO and GRC certification in Uganda at a glance
Uganda's certification conversations tend to start with a buyer, a licence or a law rather than with a standard. The Data Protection and Privacy Act, Cap. 97 puts collectors, processors and controllers on a register kept through the Personal Data Protection Office, which sits under NITA-U and asks for annual renewal, impact assessments and immediate breach reports. NITA-U's National Information Security Framework 2026 sets baseline controls for government bodies and critical infrastructure, while the Bank of Uganda supervises payment providers under the National Payment Systems Act, 2020. The Uganda National Bureau of Standards develops and enforces national standards, NEMA oversees environmental compliance, and the Occupational Safety and Health Act, 2006 governs workplaces. Demand comes from banks and mobile money, government suppliers, food processors and exporters, manufacturers in industrial parks and ICT firms. Certificates are issued by accredited certification bodies; the Uganda National Accreditation Service is the national accreditation body. Sterling's Nairobi office serves clients across Uganda, drawing on 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Uganda
Each page covers who needs the standard in Uganda, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Uganda (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Data Protection and Privacy Act, 2019 (cited by the regulator as the Data Protection and Privacy Act, Cap. 97) Personal Data Protection Office (PDPO), established by the Act under the National Information Technology Authority, Uganda (NITA-U), reporting to the Authority's Board and headed by a National Personal Data Protection Director; the Act says the office is not under the direction or control of any person or authority in performing its functions | Applies to any person, institution or public body collecting, processing, holding or using personal data within Uganda, and to those outside Uganda who do so for personal data relating to Ugandan citizens. It sets data protection principles, requires consent subject to listed exceptions, restricts children's data and special personal data (which includes financial information, health status and medical records), requires a data protection officer in institutions, security measures, processor contracts, immediate breach notification to the Authority, safeguards for processing outside Uganda and entry in a data protection register. | |
| PDPO registration, renewal and compliance services Personal Data Protection Office (PDPO) | The PDPO tells organisations to register as a data collector, data processor or data controller and to renew that registration annually; to submit a data protection impact assessment for new projects, products, systems or services that process personal data; to apply for approval to transfer personal data outside Uganda by showing adequate safeguards in the receiving country; and to report data security breaches immediately. Its portal also takes complaints from the public. | |
| National Information Security Framework (NISF) 2026 National Information Technology Authority, Uganda (NITA-U) | NITA-U states that the updated framework introduces cybersecurity assessment tools, strengthens governance requirements and sets minimum baseline security controls for critical information infrastructure and operational technology. The Minister called on ministries, departments and agencies to implement it, and urged private operators of critical infrastructure in banking, telecommunications, energy, transport and health to collaborate. The announcement does not name ISO/IEC 27001. | |
| Bank of Uganda (the central bank under the Act) Payment service providers, payment system operators and electronic money issuers | National Payment Systems Act, 2020 — the central bank regulates, supervises and licenses payment service providers and operators; payment system rules must provide for risk management and business continuity procedures; the central bank may appoint an external auditor to examine a provider (section 21); electronic money issuers must install control mechanisms for a complete audit trail (section 58). | PCI DSS, ISO/IEC 27001, ISO 22301 |
| National Information Technology Authority, Uganda (NITA-U) Government ministries, departments and agencies, and operators of critical information infrastructure | National Information Security Framework (NISF) 2026 — assessment tools, governance requirements and minimum baseline controls. | ISO/IEC 27001, ISO 22301 |
| Uganda National Bureau of Standards (UNBS) Manufacturers, food processors and traders in standardised products | Statutory body under the Ministry of Trade, Industry and Cooperatives established under Cap 327 (as amended in 2013), with a core mandate to develop, promote and enforce national standards; it certifies products under its Q-Mark and also certifies systems, and its stock of Uganda Standards includes standards harmonised with ISO, IEC, the East African Community and Codex. | ISO 9001, ISO 22000, HACCP |
| Commissioner responsible for occupational safety and health under the Act Workplaces: occupiers and employers | Occupational Safety and Health Act, 2006 — employers above the threshold in section 14 prepare and revise a written safety and health policy statement and bring it to employees' notice; workplaces are registered with the Commissioner, who issues a certificate of registration, and occupiers keep a General Register. | ISO 45001 |
| National Environment Management Authority (NEMA) Projects and facilities with environmental impacts | NEMA describes itself as the principal agency for regulating, monitoring, supervising and coordinating all activities relating to the environment; it issues environmental and social impact assessment (ESIA) certificates and runs compliance audits and inspections. | ISO 14001 |
| Enforcement bodies as the Act provides Public and private sector entities: corruption prevention | Anti-Corruption Act (Chapter 116), described in its long title as an Act for the effectual prevention of corruption in both the public and the private sector; ULII records it as assented to on 25 July 2009 and commenced on 25 August 2009. | ISO 37001, ISO 37301 |
| Uganda Civil Aviation Authority (UCAA) Civil aviation operators and maintenance organisations | UCAA lists airworthiness among its safety oversight areas and publishes the UCAA Act, regulations and directives on its site. | AS9100 |
Accreditation and recognition
- Uganda National Accreditation Service (UGANAS): National accreditation body for Uganda, operating under the Accreditation Services Act No.20 of 2021, with the principal role of accrediting and overseeing public and private conformity assessment bodies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement and disposal of public assets (PPDA) (Public Procurement and Disposal of Public Assets Authority (PPDA)): The Ministry of Finance's Doing Business Portal lists the PPDA as regulating public procurement and disposal in Uganda and issuing Supplier Registration certificates for local and for foreign suppliers. Quality or security certificates are asked for only where an individual bidding document sets them.
Economic zones
- Industrial parks developed through the Uganda Investment Authority (UIA): manufacturing, agro-processing
- Mbarara Industrial Park and Sino Mbale Industrial Park: manufacturing
Sterling in Uganda
Sterling delivers in Uganda from its Nairobi office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Uganda, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Ugandan clients ask
Do organisations in Uganda have to register with the Personal Data Protection Office?
Yes. The Data Protection and Privacy Act puts every person, institution or public body that collects or processes personal data on a data protection register, and the Personal Data Protection Office asks data collectors, processors and controllers to register and renew every year through its portal. Check how your own activities are classed with your legal adviser or the office itself.
Is there a national accreditation body in Uganda?
Yes: the Uganda National Accreditation Service (UGANAS), which works under the Accreditation Services Act No.20 of 2021 and runs schemes for laboratories, inspection bodies and certification bodies. Its international recognition page shows no signatory status, and the trade ministry has said that the facilities accredited so far used foreign accreditation bodies, so look at each certificate's accreditation mark.
What does the National Payment Systems Act expect of payment providers in Uganda?
A licence and supervision by the Bank of Uganda come first. Payment system rules must cover risk management and business continuity, the central bank may send an external auditor to examine a provider, and electronic money issuers need control mechanisms that leave a complete audit trail. Map your licence conditions with your counsel or the central bank before choosing a framework.
Does Uganda's National Information Security Framework require ISO 27001?
Not by name. NITA-U describes the 2026 framework as bringing assessment tools, stronger governance requirements and minimum baseline controls for critical information infrastructure and operational technology, and its announcement does not mention ISO/IEC 27001. A certified information security management system can still show how those controls are run. Ask NITA-U how the framework applies to you.
Must a workplace in Uganda be registered before it starts operating?
Generally, yes. The Occupational Safety and Health Act, 2006 has the Commissioner keep a register of workplaces, requires notice before premises are used as a workplace and provides for a certificate of registration. Employers above the Act's threshold also keep a written safety and health policy. Confirm the steps for your premises with the Commissioner's office or your adviser.
Which language are certification audits in Uganda carried out in?
Usually English. Acts of Parliament, the data protection office's portal and the accreditation body's site are published in English, and most business records are kept in it. Operators and suppliers may prefer a local language for interviews, so settle the audit language, any interpreter and the language of controlled documents when you apply to the certification body.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection and Privacy Act, 2019 (cited by the regulator as the Data Protection and Privacy Act, Cap. 97) — media.ulii.org; bills.parliament.ug; pdpo.go.ug (accessed 12 Oct 2026)
- PDPO registration, renewal and compliance services — pdpo.go.ug (accessed 12 Oct 2026)
- National Information Security Framework (NISF) 2026 — nita.go.ug (accessed 12 Oct 2026)
- National Payment Systems Act, 2020 — bills.parliament.ug (accessed 12 Oct 2026)
- Statutory body under the Ministry of Trade, Industry and Cooperatives established under Cap 327 (as amended in 2013), with a core mandate to develop, promote and enforce national standards; it certifies products under its Q-Mark and also certifies systems, and its stock of Uganda Standards includes standards harmonised with ISO, IEC, the East African Community and Codex — mtic.go.ug (accessed 12 Oct 2026)
- Occupational Safety and Health Act, 2006 — bills.parliament.ug (accessed 12 Oct 2026)
- NEMA describes itself as the principal agency for regulating, monitoring, supervising and coordinating all activities relating to the environment; it issues environmental and social impact assessment (ESIA) certificates and runs compliance audits and inspections — nema.go.ug (accessed 12 Oct 2026)
- Anti-Corruption Act (Chapter 116), described in its long title as an Act for the effectual prevention of corruption in both the public and the private sector; ULII records it as assented to on 25 July 2009 and commenced on 25 August 2009 — media.ulii.org (accessed 12 Oct 2026)
- UCAA lists airworthiness among its safety oversight areas and publishes the UCAA Act, regulations and directives on its site — caa.go.ug (accessed 12 Oct 2026)
- Uganda National Accreditation Service (UGANAS) — uganas.go.ug; mtic.go.ug (accessed 12 Oct 2026)
- Public procurement and disposal of public assets (PPDA) — doingbusiness.finance.go.ug (accessed 12 Oct 2026)
- Industrial parks developed through the Uganda Investment Authority (UIA) — ugandainvest.go.ug (accessed 12 Oct 2026)
- Mbarara Industrial Park and Sino Mbale Industrial Park — mtic.go.ug (accessed 12 Oct 2026)
Talk to a consultant
Plan your certification with the Nairobi team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Nairobi office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice