Where we work · Vanuatu
ISO and GRC certification consulting in Vanuatu
Achieve ISO and GRC certification in Vanuatu with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Sydney office team
- Effivity and Academy included
Sectors that ask for certification in Vanuatu
Clients include
In short
ISO and GRC certification in Vanuatu at a glance
Data protection is Vanuatu's newest compliance duty: the Data Protection and Privacy Act No. 13 of 2024 covers public and private processing, and complaints go to the Deputy Commissioner of Data Protection and Privacy within the Digital Safety Authority. Exporters answer to Biosecurity Vanuatu, which certifies agricultural exports and audits kava facilities against its OPS-014 procedure, and to the Fisheries Department's Seafood Verification Agency, which inspects seafood processors. The Vanuatu Bureau of Standards, established by the Bureau of Standards Act No. 14 of 2016, is the standards body and the regulator of Government-operated packhouses. Hotels and tour operators must meet the Department of Tourism's minimum operating standards before they receive a business licence, financial firms answer to the Vanuatu Financial Services Commission, and the Central Tender Board adjudicates higher-value Government tenders. The Asia Pacific Accreditation Cooperation lists no Vanuatu accreditation body, so certificates usually carry accreditation from another economy. Sterling's Sydney office serves Vanuatu with 8,100+ client engagements in 60+ countries and 20+ years of practice behind it, and Effivity and Sterling Academy come with every engagement.
Explore
ISO and GRC standards Sterling delivers in Vanuatu
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
ISO 22301Sterling guide to the standardISO 37001Sterling guide to the standardISO 37301Sterling guide to the standard
Financial services, payments & AML
Food safety & agriculture
FSSC 22000Sterling guide to the standardHACCPSterling guide to the standardISO 22000Sterling guide to the standard
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Vanuatu (14)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Data Protection and Privacy Act No. 13 of 2024 Deputy Commissioner of Data Protection and Privacy, appointed under the Digital Safety Authority Act No. 15 of 2024 | Applies to processing of personal data in the private and public sectors, by automated or non-automated means, wherever it is done if the data was generated or collected in Vanuatu, and to controllers or processors established elsewhere who offer goods or services to people in Vanuatu or monitor their behaviour there. It excludes purely personal or household activity. Controllers and processors must process data fairly and transparently, for explicit and legitimate purposes, keep it adequate, accurate and no longer than necessary, and apply reasonable and appropriate security measures. Processing needs one of the lawful purposes listed, special categories and children's data are prohibited unless an exception applies, and consent must be demonstrable and freely given. People have rights of access (answered in writing, free of charge, within one month), restriction, rectification, erasure, objection, human intervention in solely automated decisions, and representation in a complaint to the Deputy Commissioner or the Court. Personal data generated or collected in Vanuatu must not be used elsewhere without the Minister's prior authorisation on the Deputy Commissioner's recommendation, unless the Minister has listed the destination country or organisation by Order. The Deputy Commissioner can require documents, and the Act creates offences. Regulations may cover transparency, processors, security, records of processing and breach notification. The Act does not cite any ISO standard. | |
| Digital Safety Authority Act No. 15 of 2024 Digital Safety Authority, headed by a Commissioner appointed by the Digital Safety Commission | Section 22 lets the Commissioner appoint a Deputy Commissioner of Harmful Digital Communications and a Deputy Commissioner of Data Protection and Privacy, and section 24 gives the latter the function of receiving and determining complaints related to data protection and privacy breaches. Section 29 requires the Commissioner to set up a system for complaints about the services and decisions of a Deputy Commissioner. | |
| Vanuatu Fisheries Department, through its Seafood Verification Agency Seafood processors, exporters and fish markets | The Agency's page describes it as the seafood quality control agency that inspects and certifies Vanuatu seafood exporters and imported and exported fisheries products, applying national and relevant international seafood standards. Its core activities include inspecting processing facilities, sanitary inspection of flag vessels, developing and implementing seafood standards, inspecting local seafood markets and collecting export data. Programmes listed on the page cover water sampling, cold storage auditing and landing site auditing. | |
| Biosecurity Vanuatu Exporters of agricultural, animal and fish products | Biosecurity Vanuatu's export page says it facilitates agricultural trade in primary produce, issues export health certificates for beef products, tuna fish and live ornamental fish, and requires a certificate from the department for all agricultural exports. It lists inspection of packhouse facilities and an exporter licence among the systems in place, and says importing countries' requirements are the main factor in what exporters must meet; tuna certification follows the conditions of Australia's Department of Agriculture, Fisheries and Forestry. The department's legislation page lists the Plant Protection Act [CAP 239], Animal Importation and Quarantine Act [CAP 201], Animal Disease (Control) Act [CAP 220] and Meat Industry Act [CAP 213]. A notice on its site says applications for sanitary and phytosanitary permits and certificates in Luganville go through the Vanuatu Electronic Single Window, with imports and exports processed through customs brokers. | |
| Biosecurity Vanuatu, with the export licence issued by the Vanuatu Commodities Marketing Board Kava exporters and kava processing facilities | Biosecurity Vanuatu's kava page says it has the mandate to approve and certify kava exports, including quality standards. A kava export facility must meet the minimal requirements of its procedure OPS-014 Kava Quality Management Procedures (Export); the facility is inspected against it, a facility certification is given when all requirements are met, and the facility is audited annually. The Vanuatu Commodities Marketing Board then issues the export licence, relying on that certification. The page says kava production and export are regulated under the Kava Act of 2002, and the OPS-014 audit report form covers the building, floors, sorting and storage areas, ventilation, pest screens, water, toilets and re-drying facilities. | |
| Vanuatu Bureau of Standards (VBS) Packhouses, manufacturers and exporters working to national standards | VBS was established under the Bureau of Standards Act No. 14 of 2016. Its Act and Regulations page says that, under Council of Ministers Decision No. 51 of 2025, VBS is mandated as the official regulator of all Government-operated packhouses. VBS's news page names it the lead agency for the Santo National Packhouse, commissioned in 2026, which it describes as an export pathway guided by standards, quality assurance, traceability and standard operating procedures. VBS's standards page describes voluntary standards as those organisations adopt to satisfy market or industry demands, and mandatory standards as those that laws or regulations impose. | |
| Vanuatu Bureau of Standards (VBS) Food importers, retailers and local food producers | VBS announced a National Retail Shop Conformity-Assessment and Inspection Surveillance Exercise in October 2025, acting on a mandate from the Council of Ministers. It combines inspections of labels and expiry dates with analysis in VBS's own laboratory, covers both imported and local products, and removes non-compliant products from shelves. | |
| Department of Tourism Hotels, bungalows, tour operators and other tourism businesses | The Department's accreditation page describes a Tourism Accreditation system meant to promote a national minimum standard for operators, and says the Tourism Product Operator Minimum Standards are minimum requirements that any tourism operator in Vanuatu must meet before getting a tourism business licence. Standards are published by operator type, including accommodation, restaurants and cafes, water transport, dive operators and tour guides. Its Relevant Acts page lists the legal basis for much of its work, including the Business License Act, Food Control Act, Health and Safety Act, Environment Act, Quarantine Act and Tourism Council Act. | |
| Vanuatu Financial Services Commission (VFSC) Financial dealers, company and trust service providers, funds and virtual asset service providers | VFSC was established in December 1993 under the Vanuatu Financial Services Commission Act No. 35 of 1993, and its mission is to regulate and supervise Vanuatu's finance industry in accordance with government legislation and international standards. Its legislation page lists the Financial Dealers Licensing Act [CAP. 70], International Companies Act [CAP. 222], Mutual Funds Act No. 38 of 2005, Unit Trusts Act No. 36 of 2005, Foundation Act No. 38 of 2009 and the Virtual Assets Services Providers Act No. 3 of 2025, and publishes the Anti-Money Laundering and Counter-Terrorism Financing Act No. 13 of 2014. Its site carries licensing guidelines and anti-money-laundering guidance for licensed firms. | |
| Department of Environmental Protection and Conservation (DEPC) Developers, contractors, hotels, waste operators and processing plants | DEPC's site lists the laws it administers: the Environmental Protection and Conservation Act, Environmental Impact Assessment Regulation, National Parks Act, International Trade (Flora and Fauna) Act, Waste Management Act, Pollution Control Act and Ozone Layer Protection Act. Its EIA process runs from an application and a preliminary environmental assessment, through terms of reference, EIA studies and consultation, to an EIA report and EMMP reviewed by an EIA Review Committee, ending in an environmental permit granted or refused. The site also offers a private waste operator's licence application. | |
| Department of Labour and Employment Services, Health and Safety Unit All employers, including construction, hospitality and processing | The Unit's page says its health and safety officers ensure that employers in Vanuatu apply the requirements of the Health and Safety Act Cap 195, and that one of its major tasks is regular inspections to identify workplace hazards and recommend how employers can avoid serious accidents. The Department also lists occupational health and safety inspections among its prime functions. | |
| CERT Vanuatu (CERT VU) Organisations that hold personal or operational data online, and cyber incident response | CERT VU describes itself as the central cyber security information and incident response hub for Vanuatu, offering awareness, consultation that advises on cyber security standards, advisories and training. Its legislation page lists the Cybercrime Act No. 22 of 2021, Harmful Digital Communications Act No. 14 of 2024, Digital Safety Authority Act No. 15 of 2024, Data Protection and Privacy Act No. 13 of 2024 and the Budapest Ratification Act No. 12 of 2024, and its policies pages include the National Cyber Security Strategy 2030 and the National Data Protection and Privacy Policy. | |
| Vanuatu Foreign Investment Promotion Agency (VFIPA) Foreign investors and exporters starting or expanding a business | VFIPA describes itself as the primary point of contact for foreign investors, and says Act No. 25 of 2019 replaced the former foreign investment act [CAP 248]. Its key sectors page groups opportunities into a primary sector (agriculture, livestock, fisheries and forestry), manufacturing, construction and utilities, and services including tourism. Business start-up is supported through its eBusiness Link portal. | |
| Utilities Regulatory Authority (URA) Electricity and water utilities and their large customers | The URA describes itself as the independent regulator of electricity and water services in Vanuatu. Its site publishes tariffs per utility, monthly electricity tariff adjustments, monthly energy snapshots, network inspection reports, renewable energy pages and a National Green Energy Fund report. |
Accreditation and recognition
- Vanuatu Bureau of Standards (VBS): National standards body: it develops and adopts national standards and is a Correspondent Member of the International Organization for Standardization (ISO).
- Asia Pacific Accreditation Cooperation (APAC): Regional cooperation of accreditation bodies whose published member list shows no accreditation body for Vanuatu.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Government Contracts and Tenders [CAP. 245] and the Central Tender Board (Central Tender Board, Ministry of Finance and Economic Management): The Board coordinates and manages the Government's tender process for higher-value procurement and adjudicates and awards tenders for central government and other institutions named in the Act. Its procedures call for open and fair competition with Board approval of the tender method and documents, standard bidding documents, selective tendering with pre-qualification (in Vanuatu usually only for works) and two-stage tenders for complex needs. Lower-value procurement uses request-for-quotation forms. The Act, amended by Act 44 of 2019, sets the rules and procedures for Government contracts and tenders. The procedure pages name no general ISO certificate requirement, so read the conditions of each tender.
Sterling in Vanuatu
Sterling delivers in Vanuatu from its Sydney office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Vanuatu clients ask
Does Vanuatu have a data protection law?
Yes. The Data Protection and Privacy Act No. 13 of 2024 covers public and private processing, sets processing rules and data subject rights, and controls the use of data collected in Vanuatu elsewhere. Complaints go to the Deputy Commissioner of Data Protection and Privacy under the Digital Safety Authority Act No. 15 of 2024. Take your counsel's advice on how it applies to your operation.
Who inspects seafood and agricultural exports in Vanuatu?
Two agencies share the work. The Fisheries Department's Seafood Verification Agency inspects seafood processing facilities, vessels and landing sites, while Biosecurity Vanuatu requires its certificate for agricultural exports and issues health certificates for beef, tuna and live ornamental fish. Ask each agency which permits and inspections apply to your product and destination.
What must a kava export facility meet?
A kava export facility must meet the requirements of Biosecurity Vanuatu's OPS-014 procedure, be inspected, receive a facility certification and pass an annual audit. The Vanuatu Commodities Marketing Board then issues the export licence, relying on that certification, and the Kava Act of 2002 regulates production and export. Ask Biosecurity Vanuatu for the current procedure before you invest.
Does a tourism business need a standard before it is licensed?
Yes. The Department of Tourism says the Tourism Product Operator Minimum Standards are requirements that any operator in Vanuatu must meet before getting a tourism business licence, and it publishes them by operator type, such as accommodation, restaurants, dive operators and tour guides. They are separate from ISO certificates, so ask the Department which standard fits your business.
Which body accredits ISO certification for Vanuatu organisations?
No Vanuatu accreditation body appears on the member list of the Asia Pacific Accreditation Cooperation, so certificates usually carry accreditation from another economy within the international arrangements. The Vanuatu Bureau of Standards is the national standards body, not an accreditation body. Check the accreditation certificate of any certification body you shortlist, and ask your buyer what it accepts.
In which language are management system audits held in Vanuatu?
English is the safest working assumption. Article 3 of the Constitution names Bislama, English and French as official languages, with English and French used for education, and government sites publish mainly in English. Interviews may be easier in Bislama or French for some staff, so settle the audit language and any interpreter with the certification body early.
Next step
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection and Privacy Act No. 13 of 2024 — cert.gov.vu (accessed 18 Oct 2026)
- Digital Safety Authority Act No. 15 of 2024 — cert.gov.vu (accessed 18 Oct 2026)
- The Agency's page describes it as the seafood quality control agency that inspects and certifies Vanuatu seafood exporters and imported and exported fisheries products, applying national and relevant international seafood standards. Its core activities include inspecting processing facilities, sanitary inspection of flag vessels, developing and implementing seafood standards, inspecting local seafood markets and collecting export data. Programmes listed on the page cover water sampling, cold storage auditing and landing site auditing. — fisheries.gov.vu (accessed 18 Oct 2026)
- Biosecurity Vanuatu's export page says it facilitates agricultural trade in primary produce, issues export health certificates for beef products, tuna fish and live ornamental fish, and requires a certificate from the department for all agricultural exports. It lists inspection of packhouse facilities and an exporter licence among the systems in place, and says importing countries' requirements are the main factor in what exporters must meet; tuna certification follows the conditions of Australia's Department of Agriculture, Fisheries and Forestry. The department's legislation page lists the Plant Protection Act [CAP 239], Animal Importation and Quarantine Act [CAP 201], Animal Disease (Control) Act [CAP 220] and Meat Industry Act [CAP 213]. A notice on its site says applications for sanitary and phytosanitary permits and certificates in Luganville go through the Vanuatu Electronic Single Window, with imports and exports processed through customs brokers. — biosecurity.gov.vu (accessed 18 Oct 2026)
- Biosecurity Vanuatu's kava page says it has the mandate to approve and certify kava exports, including quality standards. A kava export facility must meet the minimal requirements of its procedure OPS-014 Kava Quality Management Procedures (Export); the facility is inspected against it, a facility certification is given when all requirements are met, and the facility is audited annually. The Vanuatu Commodities Marketing Board then issues the export licence, relying on that certification. The page says kava production and export are regulated under the Kava Act of 2002, and the OPS-014 audit report form covers the building, floors, sorting and storage areas, ventilation, pest screens, water, toilets and re-drying facilities. — biosecurity.gov.vu (accessed 18 Oct 2026)
- VBS was established under the Bureau of Standards Act No. 14 of 2016. Its Act and Regulations page says that, under Council of Ministers Decision No. 51 of 2025, VBS is mandated as the official regulator of all Government-operated packhouses. VBS's news page names it the lead agency for the Santo National Packhouse, commissioned in 2026, which it describes as an export pathway guided by standards, quality assurance, traceability and standard operating procedures. VBS's standards page describes voluntary standards as those organisations adopt to satisfy market or industry demands, and mandatory standards as those that laws or regulations impose. — vbs.gov.vu (accessed 18 Oct 2026)
- VBS announced a National Retail Shop Conformity-Assessment and Inspection Surveillance Exercise in October 2025, acting on a mandate from the Council of Ministers. It combines inspections of labels and expiry dates with analysis in VBS's own laboratory, covers both imported and local products, and removes non-compliant products from shelves. — vbs.gov.vu (accessed 18 Oct 2026)
- The Department's accreditation page describes a Tourism Accreditation system meant to promote a national minimum standard for operators, and says the Tourism Product Operator Minimum Standards are minimum requirements that any tourism operator in Vanuatu must meet before getting a tourism business licence. Standards are published by operator type, including accommodation, restaurants and cafes, water transport, dive operators and tour guides. Its Relevant Acts page lists the legal basis for much of its work, including the Business License Act, Food Control Act, Health and Safety Act, Environment Act, Quarantine Act and Tourism Council Act. — tourism.gov.vu (accessed 18 Oct 2026)
- VFSC was established in December 1993 under the Vanuatu Financial Services Commission Act No. 35 of 1993, and its mission is to regulate and supervise Vanuatu's finance industry in accordance with government legislation and international standards. Its legislation page lists the Financial Dealers Licensing Act [CAP. 70], International Companies Act [CAP. 222], Mutual Funds Act No. 38 of 2005, Unit Trusts Act No. 36 of 2005, Foundation Act No. 38 of 2009 and the Virtual Assets Services Providers Act No. 3 of 2025, and publishes the Anti-Money Laundering and Counter-Terrorism Financing Act No. 13 of 2014. Its site carries licensing guidelines and anti-money-laundering guidance for licensed firms. — vfsc.vu (accessed 18 Oct 2026)
- DEPC's site lists the laws it administers: the Environmental Protection and Conservation Act, Environmental Impact Assessment Regulation, National Parks Act, International Trade (Flora and Fauna) Act, Waste Management Act, Pollution Control Act and Ozone Layer Protection Act. Its EIA process runs from an application and a preliminary environmental assessment, through terms of reference, EIA studies and consultation, to an EIA report and EMMP reviewed by an EIA Review Committee, ending in an environmental permit granted or refused. The site also offers a private waste operator's licence application. — environment.gov.vu (accessed 18 Oct 2026)
- The Unit's page says its health and safety officers ensure that employers in Vanuatu apply the requirements of the Health and Safety Act Cap 195, and that one of its major tasks is regular inspections to identify workplace hazards and recommend how employers can avoid serious accidents. The Department also lists occupational health and safety inspections among its prime functions. — dol.gov.vu (accessed 18 Oct 2026)
- CERT VU describes itself as the central cyber security information and incident response hub for Vanuatu, offering awareness, consultation that advises on cyber security standards, advisories and training. Its legislation page lists the Cybercrime Act No. 22 of 2021, Harmful Digital Communications Act No. 14 of 2024, Digital Safety Authority Act No. 15 of 2024, Data Protection and Privacy Act No. 13 of 2024 and the Budapest Ratification Act No. 12 of 2024, and its policies pages include the National Cyber Security Strategy 2030 and the National Data Protection and Privacy Policy. — cert.gov.vu (accessed 18 Oct 2026)
- VFIPA describes itself as the primary point of contact for foreign investors, and says Act No. 25 of 2019 replaced the former foreign investment act [CAP 248]. Its key sectors page groups opportunities into a primary sector (agriculture, livestock, fisheries and forestry), manufacturing, construction and utilities, and services including tourism. Business start-up is supported through its eBusiness Link portal. — investvanuatu.vu (accessed 18 Oct 2026)
- The URA describes itself as the independent regulator of electricity and water services in Vanuatu. Its site publishes tariffs per utility, monthly electricity tariff adjustments, monthly energy snapshots, network inspection reports, renewable energy pages and a National Green Energy Fund report. — ura.gov.vu (accessed 18 Oct 2026)
- Vanuatu Bureau of Standards (VBS) — vbs.gov.vu (accessed 18 Oct 2026)
- Asia Pacific Accreditation Cooperation (APAC) — apac-accreditation.org (accessed 18 Oct 2026)
- Government Contracts and Tenders [CAP. 245] and the Central Tender Board — ctb.gov.vu (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Sydney team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
australia@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice