Our Commitment
Systems Assessment Bureau (SAB) treats the information entrusted to us by clients as confidential. This statement sets out how we safeguard it while delivering ISO certification services in the UAE, Saudi Arabia, Oman, South Africa, and the UK.
Certification and validation inevitably require access to documented information — management system records, objectives, audit findings, and evidence of conformity. We handle that material with discretion, and only to the extent needed to reach an independent and defensible decision.
What We Protect
- Client records, plans, procedures, and internal documentation shared during preparation and assessment.
- Audit evidence, findings, observations, and nonconformity reports raised during the certification process.
- Proprietary technical, commercial, and operational information belonging to the organisation.
- Personal data included in client documentation shared for assessment purposes.
- Information marked by the client as confidential or commercially sensitive.
How Information Is Handled
| Principle | Practice |
|---|---|
| Limited access | Client information is made available only to personnel involved in the assessment who require it to carry out their duties. |
| Purpose limitation | Information is used for the certification and validation activities agreed with the client, and not for unrelated purposes. |
| Secure handling | Documents are stored and transmitted through controlled channels and are safeguarded against loss, alteration, or unauthorised access. |
| Retention control | Records are retained for the period required to support the certification cycle and certification decisions, then disposed of in an orderly manner. |
| Responsible disclosure | Where a legal obligation requires disclosure, the client is notified and disclosure is limited to the minimum required. |
Impartiality and confidentiality together
Confidentiality protects the client's information; impartiality protects the integrity of the assessment. SAB addresses both, and our impartiality statement sets out how our certification decisions remain free from conflict of interest.
Client Responsibilities
Clients can support this commitment by clearly flagging information that is sensitive or restricted, and by ensuring that material shared with SAB is accurate and authorised for that use. If you consider that a request would breach your own confidentiality obligations, raise it with us at the outset so the approach can be agreed in writing.
Questions on This Statement
For clarification about how your information is handled, or to request a copy of the applicable confidentiality terms for your certification engagement, contact our team. Details are listed on the contact page, or write to info@sabcert.com.
Related pages: Logo Policy and Frequently Asked Questions.
Certification work depends on trust, and trust depends on discretion. Systems Assessment Bureau treats every piece of information entrusted by clients as confidential, from management system records and audit findings to documented evidence of conformity. Because ISO certification and validation inherently require access to such material, the process is built around limiting access, limiting purpose, and limiting retention, so that what is shared in the pursuit of an independent, defensible decision is never exposed beyond what that decision genuinely needs.
The safeguards in place begin with who is involved. Only trained auditors and assessors who are assigned to a particular engagement should see a client's documentation, and each member of the team is expected to understand the obligations that come with handling commercially sensitive material. Auditors work across multiple organisations in the course of a year, which makes clarity about the boundary between one client's records and another's essential. Information encountered during assessment is not carried into unrelated engagements, and confidentiality is treated as a professional requirement rather than a courtesy.
Storage and transmission of client information follow the same principle. Records are held in controlled environments with access restricted to authorised personnel, and electronic exchange is carried out through channels chosen for their protection rather than convenience. When documentation reaches the end of its usefulness — after certification decisions are made and any appeal or objection process concludes — it is disposed of in line with the retention arrangements that apply. Clients retain ownership of the information they submit, and the certification mark and certificate remain the outcome that stays with them.
Confidentiality extends to the conversations around the audit as well as the paperwork. Client personnel, from top management to process owners, may raise concerns, disagreements, or commercially sensitive operational issues, and these are handled without disclosure to third parties. Where information must be shared — with regulators, accreditation bodies, or external parties where an obligation exists — the client is informed, and the scope of the disclosure is kept as narrow as the obligation allows. Impartiality and confidentiality reinforce one another: neither can hold if judgement is influenced by outside interest.
This commitment applies across every region in which Systems Assessment Bureau operates, including the UAE, Saudi Arabia, Oman, South Africa, and the UK. Whether the engagement covers quality, environmental, occupational health and safety, food safety, business continuity, or related management system standards, the same expectations govern the handling of information. A certification decision is only credible if the basis for it is protected, which is why confidentiality, impartiality, and complaint handling sit alongside audit and validation as core parts of the service rather than secondary considerations.