ISO Certification in Senegal: Accredited Audits for Energy and Mining Suppliers, Banks, Exporters, and Contractors
ISO certification in Senegal helps suppliers to offshore oil, gas, and mining projects pass contractor screening, gives banks and digital service firms audited security, and lets fish and food exporters answer foreign buyers. Accredify Global audits Senegalese organizations against ISO 9001, ISO 14001, ISO 45001, ISO 27001, and the other standards in our scope.
What ISO Certification in Senegal Proves to Operators, Banks, and Buyers
ISO certification in Senegal is an accredited certification body's audited conclusion that your management system meets an international standard and is applied in real work. Auditors examine records, question staff at every level, and visit the base, mine camp, plant, or office. A conforming system earns a certificate that runs for three years, with a surveillance audit in each of the two years between.
Energy projects have changed the supplier market. Offshore developments include the Sangomar oil field and the Greater Tortue Ahmeyim gas project shared with Mauritania. They rely on Senegalese firms for logistics, catering, fabrication, and maintenance. Operators and their main contractors screen those firms on safety, environment, and quality before any work order.
Mining raises the same questions inland. Gold mines in the Kédougou region, phosphate operations around Thiès, and mineral sands along the Grande Côte all hire local haulers, drillers, and workshops. Their HSE teams ask for ISO 45001 and ISO 14001 because they cut down the paperwork at each tender.
Dakar is also a financial and digital center for French-speaking West Africa. Banks, insurers, and mobile money providers operate under the regional central bank, and telecom and data center firms serve clients across the region. These organizations ask vendors for ISO 27001 and continuity plans that can be tested.
Exports and construction complete the picture. Fish and seafood leave through the Port of Dakar for Europe and Asia, and groundnut and food processors sell regionally. Contractors building around Diamniadio and the new transport links compete on audited quality and safety.
Accredify Global is accredited by UAF, and our scope is listed in its directory. Senegal's standards body is the ASN, and regional accreditation runs through the West African system SOAC. If a tender names either one, send us the exact wording before you book and we will confirm the fit.
Senegalese Rules in 2026 That Shape Certification Requests
Personal data is governed by Act 2008-12 and the CDP. Act No. 2008-12 of 25 January 2008 sets the rules, with implementing Decree 2008-721. The Commission de Protection des Données Personnelles, or CDP, enforces them. Most processing must be declared to the CDP. Biometric, genetic, and criminal record data, and use of the national ID number, need prior authorization. Administrative fines range from XOF 1 million to XOF 100 million.
Criminal penalties also apply. Serious breaches of the data law can bring one to seven years in prison and fines of XOF 500,000 to XOF 10 million. The Act has no mandatory breach notification rule, so most incident duties come from contracts and sector rules.
A critical infrastructure law was adopted in August 2026. On 20 August 2026 the National Assembly unanimously adopted Bill 25/2026 on critical information infrastructure and digital security. It creates a National Cybersecurity Authority. Classified operators must report incidents within 24 hours of detection. They must adopt a security program within six months and run a security operations center within one year. The most serious violations carry fines of up to XOF 800 million or 5% of turnover.
Sources: Senegal data protection (DLA Piper) · Critical infrastructure bill 25/2026 (Vie Publique Sénégal) · National Assembly adoption report (Senegal7)
Standards Senegalese Clients Ask For
Operator portals, bank questionnaires, and buyer forms differ, but these standards recur.
| Sector | What the buyer worries about | Usual standards |
|---|---|---|
| Oil and gas service and logistics firms | Marine safety, spills, and permit control | ISO 45001, ISO 14001, and ISO 9001 |
| Mining contractors and haulers | Road safety, dust, and fatigue | ISO 45001 and ISO 14001 |
| Banks, insurers, and mobile money providers | Cyber risk and service continuity | ISO 27001 and ISO 22301 |
| Telecom, data center, and software firms | Uptime and client data | ISO 27001 and ISO 20000-1 |
| Fish, seafood, and groundnut processors | Cold chain, hygiene, and export checks | ISO 22000 and HACCP |
| Cement, chemical, and phosphate plants | Energy and plant safety | ISO 50001 and ISO 45001 |
| Building and infrastructure contractors | Quality on public and lender-funded works | ISO 9001, ISO 45001, and ISO 14001 |
Some energy operators and foreign buyers add their own pre-qualification or food safety schemes. ISO certificates feed those files but do not replace them.
Project suppliers gain most from one integrated system. A logistics firm might run a yard near the Port of Dakar, a base in Saint-Louis, and crews on a client site. A single ISO 45001, ISO 14001, and ISO 9001 system covers all three, with each location named on the certificate. When an operator's HSE team asks for evidence, the firm shows audited records instead of building a new file for every tender.
How ISO Supports Senegalese Requirements
A certificate does not replace a CDP declaration or a sector licence. It is the system that keeps controls in place between reviews.
| Rule or system | Who it reaches | How ISO supports it |
|---|---|---|
| Act 2008-12 on personal data | Controllers processing data in Senegal | ISO 27701 organizes declarations, consent, and rights; ISO 27001 secures the data |
| CDP prior authorizations | Biometric, genetic, and national ID processing | ISO 27701 records support the application |
| Law on critical information infrastructure (2026) | Operators classified as critical, and their suppliers | ISO 27001 covers security programs and incident handling |
| Operator and mining contractor screening | Suppliers to energy and mining projects | ISO 45001, ISO 14001, and ISO 9001 support HSE and quality scoring |
| Public procurement | Firms bidding for state and lender-funded contracts | Certificates strengthen the technical file |
Some duties need testing rather than certification. Our VAPT services and cyber security risk assessment report against recognized frameworks. Card issuers and acquirers can add PCI DSS readiness, and our compliance services cover GDPR for firms handling European customer data. Hydrocarbon local content duties are a separate legal matter that a certificate does not settle.
Planning a Certification Audit in Senegal
Local details that keep a Senegalese audit on schedule.
Prepare before Stage 1
- RCCM registration and NINEA for each entity
- Yards, bases, camps, plants, and offices in scope
- The operator, bank, or tender requirement
- Subcontractors and day labor on site
Scheduling notes
- Offices work Monday to Friday
- Tabaski, Korité, and the Magal of Touba close many sites
- The rainy season slows roads to Kédougou
- Records and the audit can run in French
How ISO Certification in Senegal Works With Us
Six steps from the first call to a certificate an operator can verify. Our certification process guide explains every stage.
Does a pre-qualification or tender window close soon? Give us the date and we will schedule the audit around it.
Book a free scoping reviewWhat ISO Certification Costs in Senegal
The fee is built from audit man-days, shown per site and per standard in your proposal before you accept.
What adds days
- Remote camps or bases far from Dakar
- Marine, mining, or heavy lifting work
- Many subcontracted or seasonal staff
- Standards audited one at a time
What saves days
- One integrated system for every site
- Head-office procedures used at each base
- Records complete before Stage 1
- Internal audit and management review finished
What Senegalese Organizations Ask Us First
Short answers for HSE, quality, compliance, and IT security leads.
| Question | Our answer |
|---|---|
| Who accredits Accredify Global? | UAF, for twelve standards in its directory. |
| Can one certificate cover a Dakar yard and a mine camp? | Yes, as a multi-site certificate. |
| How does an operator check it? | On our verification page. |
| Will you prepare our manuals? | No. We only audit, to stay impartial. |
| How is the fee calculated? | From audit man-days, in writing. |
FAQ: ISO Certification in Senegal
Answers on energy and mining suppliers, Act 2008-12, the 2026 CII law, cost, and timing.
How does a company get ISO certification in Senegal?
Select the standard your operator, bank, or tender requires and run the system until it produces records. Then book Stage 1 and Stage 2 audits. If you conform, you receive a certificate valid for three years.
How long does certification take for a Senegalese firm?
Where the system is already in use, most firms are certified 6 to 12 weeks after Stage 1. Remote sites, more standards, or a new system extend that.
What drives the price of ISO certification in Senegal?
Audit man-days. Staff numbers, site count, travel to remote locations, risk, and the standards chosen set the days.
Who accredits Accredify Global?
UAF accredits us for twelve standards, including ISO 9001, ISO 14001, ISO 45001, ISO 27001, and ISO 22301.
Will energy operators in Senegal accept a UAF-accredited certificate?
Most accept accredited certificates from bodies in the international arrangement. If an operator or tender cites ASN, SOAC, or another body, share the clause before booking.
Must we declare processing to the CDP?
Under Act 2008-12, most processing must be declared to the CDP. Biometric, genetic, criminal record, and national ID processing need prior authorization.
Is breach notification mandatory under Act 2008-12?
No. The Act has no mandatory breach notification rule. Critical operators under the 2026 law face a 24-hour incident notice instead.
What is the 2026 law on critical information infrastructure?
It is Bill 25/2026, adopted by the National Assembly on 20 August 2026. It sets security programs, 24-hour incident notice, and fines for classified operators.
Does ISO 27001 help with the critical infrastructure law?
Yes. It gives a classified operator or its supplier a documented security program, risk assessment, and incident process that auditors have tested.
Does ISO 27701 support CDP compliance?
It helps. It adds privacy roles, records of processing, rights handling, and authorization tracking to an ISO 27001 system.
Can you audit a mine contractor in the Kédougou region?
Yes. We plan travel around the rainy season and agree site inductions with the mine in advance.
Which standard should an oil and gas supplier start with?
Most start with ISO 45001 and ISO 9001 and add ISO 14001 for marine or waste work. All three can be audited together.
Can audits and documents be in French?
Yes. Records can stay in French, and the audit language is confirmed in the proposal.
Can some of the audit be remote?
Document review and some interviews can be remote where the rules allow. Bases, camps, plants, and offices are audited in person.
Will Accredify Global build our management system?
No. A certification body must stay impartial, so we audit and certify only. Your team or an independent consultant builds the system.
Bring an Audited System to Your Next Senegalese Tender
Tell us your entity, sites, and the operator, bank, or tender requirement. We will confirm the right ISO certification in Senegal and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global certification team.