Where we work · Ukraine
ISO and GRC certification consulting in Ukraine
Achieve ISO and GRC certification in Ukraine with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Ukraine
Clients include
ISO and GRC certification in Ukraine at a glance
Ukraine's Law on Personal Data Protection, No. 2297-VI, takes effect from 1 January 2011 under its final provisions, and the Ukrainian Parliament Commissioner for Human Rights supervises it through inspections, binding orders and notices of special-risk processing. A draft replacement, No. 8153, is before the Verkhovna Rada but is not law. Banks follow a National Bank resolution that requires an information security management system under DSTU ISO/IEC 27001, food operators must run HACCP-based procedures under the food safety law, and public buyers must accept certificates from accredited bodies. The National Accreditation Agency of Ukraine (NAAU) accredits those bodies and states its EA and Global ACI recognitions. Demand comes from agri-food exporters, IT services firms, banks, metals and machinery makers and pharmaceutical producers. Sterling works with Ukrainian organisations today, serving them from its Frankfurt office with 8,100+ client engagements in 60+ countries, 20+ years of experience, and Effivity and Sterling Academy included with the engagement. Audits and consulting are delivered remotely, or on site only where it is safe to do so. Certificates come from accredited certification bodies, never from Sterling.
ISO and GRC standards Sterling delivers in Ukraine
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Ukraine (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law of Ukraine "On Personal Data Protection" (Про захист персональних даних) No. 2297-VI of 1 June 2010 Ukrainian Parliament Commissioner for Human Rights (Уповноважений Верховної Ради України з прав людини; the Commissioner, also called the Ombudsman); Article 22 names the Commissioner and the courts as the bodies that control compliance | Applies to processing done wholly or partly by automated means and to personal data held in, or meant for, a filing system. Bases for processing include consent, a legal permission, a contract, vital interests, a legal duty and the controller's legitimate interests where these are not overridden by the person's rights. Processing of special categories (race or ethnicity, political, religious or philosophical beliefs, party or union membership, criminal convictions, health, sex life, biometric and genetic data) is prohibited unless an exception applies, such as unambiguous consent or employment law needs. People must be told who the controller is, what is collected, their rights, the purpose and the recipients at the time of collection. Data subjects can see their data, object, demand correction or deletion, withdraw consent, learn how automated processing works, ask for protection from an automated decision with legal effect, and complain to the Commissioner or a court; access to one's own data is free. Controllers must notify the Commissioner of processing that poses a special risk to rights and freedoms, as the Commissioner defines. Controllers, processors and third parties must protect data against accidental loss, destruction and unlawful processing, and a unit or responsible person organises protection where processing is subject to notification (and in public bodies), with its details sent to the Commissioner for publication. A processor works under a written contract and only for the purpose and scope it sets. Transfers to foreign parties are allowed where the state ensures adequate protection (EEA states and signatories of the Council of Europe convention are recognised as doing so; the Cabinet of Ministers sets the list) or in listed cases such as unambiguous consent, a contract, vital interests, public interest or a legal claim, or safeguards given by the controller. The Commissioner can run on-site and off-site inspections, issue binding orders and draw up administrative offence reports for the courts. The Law contains no separate personal data breach notification article and refers liability to other legislation. | |
| Commissioner's acts under the Law: Model Procedure for Personal Data Processing and the Procedure for notifying the Commissioner of processing that poses a special risk Ukrainian Parliament Commissioner for Human Rights | The Commissioner states that its planned inspections cover compliance with the Law, with the Model Procedure and with the notification procedure. The Law gives the Commissioner the power to approve such acts and to define the types of special-risk processing that must be notified. | |
| Draft Law "On Personal Data Protection" No. 8153 (not in force) Verkhovna Rada of Ukraine (legislature); the draft is not law and does not change the duties of the Law in force | The Rada's bill card, not any forecast, is the place to check the draft's current stage; the committee on European integration records that the draft needs further work to reflect provisions of the EU General Data Protection Regulation, and the budget committee's opinion refers to a body that would supervise and control compliance with it. | |
| National Bank of Ukraine (NBU) Banks | Regulation on the organisation of information security measures in the banking system of Ukraine, approved by NBU Board Resolution of 28 September 2017 No. 95, printed on zakon.rada.gov.ua as in force. A bank must implement an information security management system under DSTU ISO/IEC 27001:2015 for a defined scope (the minimum scope is all critical business processes), apply the controls of its Annex A under DSTU ISO/IEC 27002:2015 with a risk-based approach, and approve a business continuity plan that covers the continuity of information security measures. | ISO/IEC 27001, ISO 22301 |
| State Service of Ukraine on Food Safety and Consumer Protection (SSUFSCP; Держпродспоживслужба) Food producers, processors, storage and trade (market operators) | Law "On Basic Principles and Requirements for the Safety and Quality of Food Products" No. 771/97-VR of 23 December 1997 (edition of 22 July 2026 on zakon.rada.gov.ua). Market operators must develop, introduce and use permanent procedures based on HACCP principles, with a simplified approach allowed in cases the Law lists and primary production excluded; operators of animal-origin food production and storage must hold an operating permit; traceability must be kept at all stages. SSUFSCP's site carries sections on state registration of facilities, operating permits, a HACCP system page, export certificates and the requirements of foreign countries. | HACCP, ISO 22000, FSSC 22000 |
| Ukrainian Medicine Agency (its English pages also use the abbreviation SMDC, the State Service of Ukraine on Medicines and Drugs Control) Medical devices and medicines | Technical Regulation on Medical Devices approved by Cabinet of Ministers Resolution of 2 October 2013 No. 753 (with companion regulations No. 754 on in vitro diagnostic devices and No. 755 on active implantable devices); the agency's site lists market surveillance, a State register of medical equipment and medical devices, and certification of the manufacture of medicines. | ISO 13485 |
| State Service of Special Communications and Information Protection (a main subject of the national cyber protection system under the Law); the National Bank for the banking, non-bank financial and payment sectors Cyber protection of critical information infrastructure, e-commerce and e-government systems | Law "On Basic Principles of Ensuring Cyber Security of Ukraine" No. 2163-VIII of 5 October 2017 (edition of 19 October 2025). It lists as objects of cyber protection the systems used for e-government, electronic services, e-commerce and electronic document flow, and critical information infrastructure, and it gives the National Bank the task of forming and running the register of critical information infrastructure objects in the banking system, on non-bank financial markets and among payment system operators. | ISO/IEC 27001, PCI DSS, SOC 2 |
| Central executive body for energy efficiency policy, as the Law describes it Energy users, public bodies and their enterprises | Law "On Energy Efficiency" No. 1818-IX of 21 October 2021 (edition of 1 October 2026). Article 12 provides that energy management systems are implemented under Ukrainian national standards harmonised with international ones, that certification of such systems is done by certification bodies accredited in Ukraine under the law and is voluntary except where the Law says otherwise, and that public authorities and the enterprises in their sphere must run energy management systems in the order the Cabinet of Ministers sets; energy audits are carried out by independent qualified energy auditors. | ISO 50001 |
| Employers under the Law, supervised by the state authorities that the Law on Labour Protection and related legislation name All employers (occupational safety and health) | Law "On Labour Protection" No. 2694-XII of 14 October 1992 (edition of 12 September 2025). Article 13 requires an employer to create working conditions that meet the legal acts and to run a labour protection management system, including services and responsible officers, preventive measures, investigation follow-up, and labour protection audits and workplace assessments. | ISO 45001 |
| Authorities designated under the Law on Environmental Impact Assessment Industry, energy, extraction and infrastructure projects | Law "On Environmental Impact Assessment" No. 2059-VIII of 23 May 2017 (edition of 16 September 2026). Article 3 makes an environmental impact assessment mandatory before a decision to carry out the planned activities it lists in two categories. | ISO 14001 |
| National Agency on Corruption Prevention, under the Law on Prevention of Corruption State and municipal enterprises, and suppliers in larger public tenders | Law "On Prevention of Corruption" No. 1700-VII of 14 October 2014 (edition of 30 May 2026). Article 62 makes an anti-corruption programme mandatory for state and municipal enterprises and companies above stated staffing and revenue levels, and for legal entities taking part in a public procurement above a value level the Law sets; the programme needs an appointed responsible officer, and Article 63 lists what it may contain, including periodic corruption risk assessment. | ISO 37001, ISO 37301 |
| National standardization body, a state enterprise (UkrNDNC, Ukraine Standards) under the Law on Standardization Standards (DSTU national standards) | Law "On Standardization" No. 1315-VII of 5 June 2014. Article 11 provides that a state enterprise performs the national standardization body's functions; Article 23 provides that national standards are applied on a voluntary basis unless legal acts make them mandatory. The body's site presents it as the national standardization body and publishes DSTU texts (standards role only). | ISO 9001, ISO/IEC 27001 |
Accreditation and recognition
- National Accreditation Agency of Ukraine (NAAU; Національне агентство з акредитації України): National accreditation body — accredits testing and calibration laboratories (DSTU EN ISO/IEC 17025), product, process and service certification bodies (17065), management systems certification bodies (17021-1), personnel certification bodies (17024), inspection bodies (17020), medical laboratories (15189), proficiency testing providers, verification bodies and reference material producers, under the Law "On Accreditation of Conformity Assessment Bodies"; NAAU was founded by order of the Ministry of Economic Development and Trade of 4 January 2002.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Law "On Public Procurement" No. 922-VIII of 25 December 2015 (Procuring entities, under the Law (edition of 24 August 2026)): Tender documents may require marks, test reports or certificates that confirm the subject of the procurement meets the buyer's requirements. Article 23 provides that they must be issued by conformity assessment bodies whose competence is confirmed by accreditation or in another way the legislation sets, and that a buyer who cites a specific mark, report or certificate must accept equivalent ones. Any certificate requirement sits in the individual tender, not in a general rule.
- Anti-corruption programme for larger public tenders (Legal entities taking part in procurement, under Article 62 of the Law on Prevention of Corruption): A legal entity that takes part in a public procurement at or above the value level the Law sets must have an approved anti-corruption programme and a responsible officer. The Law does not name ISO 37001 or ISO 37301; a management system built on either can support the programme.
Economic zones
- Industrial parks under the Law "On Industrial Parks" No. 5018-VI of 21 June 2012:
- Diia.City (a legal and tax space for IT companies): IT services and software
Sterling in Ukraine
Sterling delivers in Ukraine from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Ukraine clients ask
Is Ukraine's personal data law in force, and who supervises it?
Yes. Law No. 2297-VI "On Personal Data Protection" takes effect from 1 January 2011 under its final provisions and is printed as current on the Rada's legislation site. The Ukrainian Parliament Commissioner for Human Rights, with the courts, controls compliance. Its duties are set out in the Law's text, so check your own position with counsel or the Commissioner.
Is a new personal data law about to replace the current one in Ukraine?
A replacement draft, No. 8153, is before the Verkhovna Rada, but it is not law and does not change today's duties. The Rada's bill card shows it adopted as a basis in December 2023 and being prepared for second reading. Follow that card for its stage, and confirm any change with counsel or the Commissioner.
Which body accredits certification bodies in Ukraine?
The National Accreditation Agency of Ukraine (NAAU) is the national accreditation body. It states that it accredits management systems certification bodies against DSTU EN ISO/IEC 17021-1, is a signatory to the EA MLA and is a full member of Global ACI. Ask any candidate certification body to show its accreditation certificate and scope.
Do Ukrainian banks have to implement ISO 27001?
For banks, in effect yes: the National Bank's information security regulation requires a bank to implement an information security management system under DSTU ISO/IEC 27001:2015 for a defined scope, with all critical business processes as the minimum. The regulation does not demand an external certificate. Other firms follow their customers' contracts; confirm details with the National Bank.
Are food businesses in Ukraine required to run HACCP?
Market operators must develop, introduce and use permanent procedures based on HACCP principles under the food safety law, with a simplified approach allowed in listed cases and primary production excluded. A third-party HACCP or ISO 22000 certificate is a separate, commercial step that buyers may ask for. Check your category with the State Service on Food Safety.
Which language is used for audits in Ukraine?
Mostly Ukrainian on the shop floor and in dealings with the Commissioner, the National Bank or the ministries, and often English in software, outsourcing and export firms. Audit language is a matter for negotiation: decide it, together with any interpreter and the language of controlled documents, when you apply to the certification body, and honour any tender or contract language rule.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law of Ukraine "On Personal Data Protection" (Про захист персональних даних) No. 2297-VI of 1 June 2010 — zakon.rada.gov.ua (accessed 17 Oct 2026)
- Commissioner's acts under the Law: Model Procedure for Personal Data Processing and the Procedure for notifying the Commissioner of processing that poses a special risk — ombudsman.gov.ua (accessed 17 Oct 2026)
- Draft Law "On Personal Data Protection" No. 8153 (not in force) — itd.rada.gov.ua (accessed 17 Oct 2026)
- Regulation on the organisation of information security measures in the banking system of Ukraine, approved by NBU Board Resolution of 28 September 2017 No. 95, printed on zakon.rada.gov.ua as in force. A bank must implement an information security management system under DSTU ISO/IEC 27001:2015 for a defined scope (the minimum scope is all critical business processes), apply the controls of its Annex A under DSTU ISO/IEC 27002:2015 with a risk-based approach, and approve a business continuity plan that covers the continuity of information security measures — zakon.rada.gov.ua (accessed 17 Oct 2026)
- Law "On Basic Principles and Requirements for the Safety and Quality of Food Products" No. 771/97-VR of 23 December 1997 (edition of 22 July 2026 on zakon.rada.gov.ua). Market operators must develop, introduce and use permanent procedures based on HACCP principles, with a simplified approach allowed in cases the Law lists and primary production excluded; operators of animal-origin food production and storage must hold an operating permit; traceability must be kept at all stages. SSUFSCP's site carries sections on state registration of facilities, operating permits, a HACCP system page, export certificates and the requirements of foreign countries — zakon.rada.gov.ua; dpss.gov.ua (accessed 17 Oct 2026)
- Technical Regulation on Medical Devices approved by Cabinet of Ministers Resolution of 2 October 2013 No. 753 (with companion regulations No. 754 on in vitro diagnostic devices and No. 755 on active implantable devices); the agency's site lists market surveillance, a State register of medical equipment and medical devices, and certification of the manufacture of medicines — dls.gov.ua (accessed 17 Oct 2026)
- Law "On Basic Principles of Ensuring Cyber Security of Ukraine" No. 2163-VIII of 5 October 2017 (edition of 19 October 2025). It lists as objects of cyber protection the systems used for e-government, electronic services, e-commerce and electronic document flow, and critical information infrastructure, and it gives the National Bank the task of forming and running the register of critical information infrastructure objects in the banking system, on non-bank financial markets and among payment system operators — zakon.rada.gov.ua (accessed 17 Oct 2026)
- Law "On Energy Efficiency" No. 1818-IX of 21 October 2021 (edition of 1 October 2026). Article 12 provides that energy management systems are implemented under Ukrainian national standards harmonised with international ones, that certification of such systems is done by certification bodies accredited in Ukraine under the law and is voluntary except where the Law says otherwise, and that public authorities and the enterprises in their sphere must run energy management systems in the order the Cabinet of Ministers sets; energy audits are carried out by independent qualified energy auditors — zakon.rada.gov.ua (accessed 17 Oct 2026)
- Law "On Labour Protection" No. 2694-XII of 14 October 1992 (edition of 12 September 2025). Article 13 requires an employer to create working conditions that meet the legal acts and to run a labour protection management system, including services and responsible officers, preventive measures, investigation follow-up, and labour protection audits and workplace assessments — zakon.rada.gov.ua (accessed 17 Oct 2026)
- Law "On Environmental Impact Assessment" No. 2059-VIII of 23 May 2017 (edition of 16 September 2026). Article 3 makes an environmental impact assessment mandatory before a decision to carry out the planned activities it lists in two categories — zakon.rada.gov.ua (accessed 17 Oct 2026)
- Law "On Prevention of Corruption" No. 1700-VII of 14 October 2014 (edition of 30 May 2026). Article 62 makes an anti-corruption programme mandatory for state and municipal enterprises and companies above stated staffing and revenue levels, and for legal entities taking part in a public procurement above a value level the Law sets; the programme needs an appointed responsible officer, and Article 63 lists what it may contain, including periodic corruption risk assessment — zakon.rada.gov.ua (accessed 17 Oct 2026)
- Law "On Standardization" No. 1315-VII of 5 June 2014. Article 11 provides that a state enterprise performs the national standardization body's functions; Article 23 provides that national standards are applied on a voluntary basis unless legal acts make them mandatory. The body's site presents it as the national standardization body and publishes DSTU texts (standards role only) — zakon.rada.gov.ua; uas.gov.ua (accessed 17 Oct 2026)
- National Accreditation Agency of Ukraine (NAAU; Національне агентство з акредитації України) — naau.org.ua (accessed 17 Oct 2026)
- Public procurement under the Law "On Public Procurement" No. 922-VIII of 25 December 2015 — zakon.rada.gov.ua (accessed 17 Oct 2026)
- Anti-corruption programme for larger public tenders — zakon.rada.gov.ua (accessed 17 Oct 2026)
- Industrial parks under the Law "On Industrial Parks" No. 5018-VI of 21 June 2012 — zakon.rada.gov.ua
- Diia.City (a legal and tax space for IT companies) — city.diia.gov.ua; zakon.rada.gov.ua
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice