EU rules for Surinamese suppliers

European laws do not apply in Suriname, but your European customer must comply and passes the requirements on to you: through contracts, questionnaires and audits. If you supply timber, cocoa or coffee to the EU, the Deforestation Regulation (EUDR) applies from 30 December 2026. If you supply IT or other services to Dutch organisations, expect questions under the Dutch Cybersecurity Act (in force since 15 August 2026) and the GDPR. From 14 December 2027 the EU ban on products made with forced labour applies.

EUDR

30 Dec

2026, large and medium EU companies

NIS2 in the Netherlands

15 Aug

2026, Cybersecurity Act in force

Forced labour

14 Dec

2027, ban on the EU market

On this page (13)

Why EU rules reach you
EUDR: deforestation-free products
NIS2 and the Dutch Cybersecurity Act
GDPR: personal data of Europeans
Food: safety, residues and labelling
CSRD and CSDDD after the Omnibus
Ban on products made with forced labour
CBAM: carbon border charge
Step by step: handling a customer questionnaire
Checklist per rule
What if...
Sources
Frequently asked questions

In short

EUDR: timber, cocoa, coffee, palm oil, rubber, soy and cattle. Your buyer asks for the GPS location of every plot and evidence of legal, deforestation-free production (no deforestation after 31 December 2020). The EU classifies Suriname as low risk; that makes things simpler for your buyer, but geolocation is still required.
NIS2 / Dutch Cybersecurity Act: your customer must assess its suppliers. Expect a security questionnaire and contract clauses on security and incident reporting.
GDPR: applies to you directly if you serve people in the EU or process data for an EU customer. Your customer will require a data processing agreement and usually Standard Contractual Clauses.
Food: EU border checks, maximum residue levels for pesticides, contaminants and labelling rules. Test before you ship.
CSRD and CSDDD were cut back sharply in February 2026. Small suppliers have to provide much less than first expected.
CBAM (carbon border charge) only covers steel, aluminium, cement, fertiliser, hydrogen and electricity: not relevant for most Surinamese exporters.

Why EU rules reach you

A European company that places a product on the EU market or buys a service is itself responsible for compliance. If it cannot show that your product or service meets the rules, it risks fines or may not sell your product. So it passes the obligation down the chain: in the purchase contract, a supplier code of conduct, a questionnaire or an audit. For you this is not a legal duty but a commercial one: if you cannot show it, you lose the customer.

The overview below shows which rule affects whom. Dates are as of 26 October 2026; many of these rules were postponed or relaxed in 2025 and 2026, so check the current status before you invest.

Rule	Who in Suriname notices it	From	What your customer asks
EUDR (deforestation)	Exporters of timber and wood products, cocoa, coffee, palm oil, rubber, soy, cattle	30 December 2026; micro and small (non-timber) 30 June 2027	Geolocation of plots, proof of legality, chain documents
NIS2 / Dutch Cbw (cybersecurity)	IT firms, software developers, call centres and back offices, hosting, anyone with access to customer systems or data	Netherlands: 15 August 2026	Security questionnaire, contract addendum, evidence of measures, fast incident reporting
GDPR (privacy)	Web shops and travel agencies with EU customers, data processors for EU companies	Since 25 May 2018	Data processing agreement, Standard Contractual Clauses, security measures
Food safety	Exporters of fish, shrimp, vegetables, fruit, herbs, rice and processed food	Already applies	Lab reports, certificates, EU-compliant label, traceability
Forced labour	All exporters to the EU, especially in labour-intensive chains	14 December 2027	Policies, contracts, payroll records, list of subcontractors
CSRD / CSDDD	Suppliers to very large EU groups	Phased, CSDDD from 26 July 2029	Limited sustainability data: energy, emissions, staff
CBAM	Rarely: only exporters of steel, aluminium, cement, fertiliser	1 January 2026	Emissions data per installation

EUDR: deforestation-free products

The EU Deforestation Regulation (Regulation (EU) 2023/1115) bans placing on the EU market, or exporting from the EU, seven commodities and products made from them unless they are deforestation-free (no deforestation or forest degradation after 31 December 2020), legally produced under the laws of the country of production, and covered by a due diligence statement from the company placing them on the EU market.

Which products

Cattle, cocoa, coffee, oil palm, rubber, soy and wood, plus derived products such as chocolate, furniture, paper, charcoal and many wood products. The list changed in 2025 and 2026: printed products such as books were removed (December 2025), and from 18 September 2026 leather, retreaded tyres and certain rubber articles, among others, were taken off the list. Soluble coffee, certain palm oil derivatives and frozen cattle tongues are added from 30 December 2027. Check your product's CN code in the annex to the regulation.

Dates

30 December 2026: large and medium-sized companies and traders, and micro and small companies in the timber sector.
30 June 2027: micro and small companies outside the timber sector.
This follows two postponements (December 2024 and Regulation (EU) 2025/2650 of December 2025). In its simplification review of 4 May 2026 the European Commission confirmed there will be no further delay.

What "low risk" for Suriname means

The European Commission classifies countries as low, standard or high risk. Suriname (and Guyana) are in the low risk category. Your EU customer may then apply simplified due diligence: it must collect the information but need not carry out a full risk assessment and risk mitigation, unless there are substantiated concerns. Geolocation and proof of legality are therefore still required. The classification is reviewed periodically.

What your customer asks you for

Geolocation of every plot where the commodity was produced: GPS coordinates, and for plots larger than 4 hectares (except for cattle) a polygon of the boundaries.
Proof of legality: concession, logging permit or land title, SBB documents for timber, and compliance with environmental, labour and tax laws among others.
Chain data: quantity, date or period of production, suppliers and buyers, so the batch can be traced back to the plots.
Sometimes satellite images or a statement that no forest was cleared on those plots after 2020.

For Surinamese exporters this is mainly about timber and wood products. If you export timber to Asia or the region you are not covered; only what enters the EU counts. Export procedures and SBB inspection: Exporting from Suriname. Agriculture: Starting an agribusiness.

NIS2 and the Dutch Cybersecurity Act

The European NIS2 Directive (2022/2555) requires organisations in sectors such as energy, transport, banking, health, drinking water, digital infrastructure and ICT service management to have proper cybersecurity. The Netherlands implemented NIS2 in the Cybersecurity Act (Cyberbeveiligingswet, Cbw), which according to the National Cyber Security Centre entered into force on 15 August 2026. Other EU countries have their own NIS2 laws with other dates.

The Cbw does not apply in Suriname. But an organisation covered by it must carry out a risk analysis, take appropriate measures and also manage security in its supply chain: set requirements for suppliers and check they are met. That affects Surinamese companies doing IT management, software, hosting, call centre or back-office work for Dutch customers. Suppliers that process personal data or have access to customer systems get the questions first.

What to expect

A security questionnaire or supplier assessment, often yearly.
A contract addendum with requirements on access control, encryption, backups, logging and incident reporting. NIS2 organisations must send an early warning of a significant incident to their CSIRT within 24 hours, so they want to hear it from you even faster.
A request for evidence: policies, a named person in charge, test reports, training records, possibly an ISO 27001 certificate.

GDPR: personal data of Europeans

The General Data Protection Regulation (Regulation (EU) 2016/679) applies to Surinamese companies in two ways:

Directly, if you offer goods or services to people in the EU (a web shop delivering to the Netherlands, a travel agency or resort marketing to European guests) or monitor their behaviour online (article 3(2)). In principle you must then also appoint a representative in the EU (article 27), with limited exceptions for occasional processing.
Through your customer, if you process personal data on behalf of an EU company: payroll, customer service, IT management, data entry. You are then a processor. Your customer must sign a data processing agreement with you (article 28) and may only transfer the data to Suriname with a valid transfer tool, because the EU has no adequacy decision for Suriname. In practice that means the European Commission's Standard Contractual Clauses.

Fines can reach EUR 20 million or 4% of worldwide annual turnover. Suriname is working on its own personal data protection law; see New laws and rules. How this site handles data is on our Privacy page.

Food: safety, residues and labelling

Food faces the strictest EU rules, and the EU checks them at its own border (Regulation (EU) 2017/625 on official controls):

Animal products (fish, shrimp, meat, honey) may only enter the EU from countries and establishments approved by the EU, with an official health certificate, through a border control post. For fish the Fish Inspection Institute (VKI) is the competent authority, and a catch certificate against illegal fishing is also required.
Pesticide residues: the EU sets maximum residue levels per substance and product (Regulation (EC) No 396/2005). Where there is no specific limit for a substance, a default limit of 0.01 mg/kg applies. A product allowed in Suriname may be banned in the EU.
Contaminants: maximum levels for, among others, aflatoxins, heavy metals in fish and PAHs (Regulation (EU) 2023/915).
Plants and fresh produce: a phytosanitary certificate from Agriculture (LVV) and EU plant health rules; some fruits have extra requirements, as with mangoes (see Exporting from Suriname).
Label (Regulation (EU) No 1169/2011): in the language of the EU country, with name, ingredients, allergens emphasised in the ingredients list, net quantity, date of minimum durability or use-by date, storage conditions, name and address of the responsible operator and, where required, the country of origin.

Certain products from certain countries face temporarily increased checks (Implementing Regulation (EU) 2019/1793). Suriname was not on that list in the January 2026 amendment we checked. A rejected shipment does go into the EU alert system RASFF, and repeated rejections can lead to stricter checks. So test before shipping in an accredited laboratory and ask your buyer which residues it checks itself.

CSRD and CSDDD after the Omnibus

Sustainability reporting (CSRD) and supply chain due diligence (CSDDD) were cut back sharply by the so-called Omnibus I Directive, published on 26 February 2026 and in force since 18 March 2026:

CSRD now applies to EU companies or groups with more than 1,000 employees and more than EUR 450 million net turnover (plus certain non-EU groups with large EU turnover). Member states must transpose this by 19 March 2027.
There is a value chain cap: a reporting company may only ask limited information from value chain partners with fewer than 1,000 employees. If a customer asks for much more, you may ask what the request is based on.
CSDDD now only applies to companies with more than 5,000 employees and more than EUR 1.5 billion turnover, and only from 26 July 2029.

Sustainability questionnaires will keep coming anyway: from large customers with their own policies, from banks, and through labels such as FSC for timber. Having some basic data ready saves a lot of work: yearly energy and fuel use, number of employees, accidents, and your policies on environment, safety and labour.

Ban on products made with forced labour

Regulation (EU) 2024/3015 bans placing on the EU market, and exporting from the EU, products made with forced labour at any stage. The ban applies from 14 December 2027, to all products and all company sizes. Authorities investigate on a risk basis; once a ban is decided, the product must be taken off the market. The European Commission published guidelines on 26 June 2026, and decisions are published on a central portal.

Your customer will therefore want to show there is no forced labour in its chain. Expect questions on recruitment (no recruitment fees charged to workers, no retained passports), employment contracts, wage payment, working hours, subcontractors and a grievance procedure. Higher-risk sectors include mining, fishing, agriculture, forestry and construction. Labour law in Suriname: Labour law basics.

CBAM: carbon border charge

The Carbon Border Adjustment Mechanism (Regulation (EU) 2023/956) charges for the CO2 emissions of imported iron and steel, aluminium, cement, fertiliser, hydrogen and electricity. The definitive phase has applied since 1 January 2026. After the simplification of October 2025 (Regulation (EU) 2025/2083) an importer is exempt if it imports no more than 50 tonnes of CBAM goods a year (not for electricity and hydrogen). The importer buys certificates from February 2027 for 2026 imports and files its first annual declaration by 30 September 2027.

Suriname hardly exports these goods to the EU. If you do supply steel or aluminium products, your customer will ask for actual emissions per installation; without them it uses the Commission's default values, which usually come out higher.

Step by step: handling a customer questionnaire

Ask which rule is behind it. EUDR, Dutch Cbw, GDPR or the customer's own policy? Then you know what is really required and what is a wish.
Appoint one person to coordinate the answers and track what you have promised.
Collect evidence in one folder: permits, maps and coordinates, policies, certificates, test reports, contracts with subcontractors.
Answer honestly. Say what you do and do not have, and give a date for what is missing. An answer that is too good and later proves wrong will cost you the customer.
Read contract clauses carefully before you sign: notification deadlines, audit rights, liability and penalty clauses. Have them changed if needed.
Discuss costs. GPS mapping, lab tests and certification cost money. Large customers sometimes contribute or offer help.
Keep it up to date. Set reminders for yearly questionnaires and expiring certificates.

Checklist per rule

EUDR (timber, cocoa, coffee)

List of all plots with a GPS point, or a polygon for more than 4 hectares
Concession, logging permit, land title or lease per plot
SBB inspection documents and transport documents for timber
Records linking each batch to the plots of origin
Evidence that no forest was cleared after 31 December 2020 (for example satellite images)

Cybersecurity (NIS2)

Written information security policy and a person in charge
Multi-factor authentication on email, admin and remote access
Backups that you have actually restored as a test
Updates and patches on a fixed schedule
Incident procedure with a contact person and a notification deadline towards the customer
Yearly staff training, with records

GDPR

Overview of which personal data you process, for whom and why
Data processing agreement and Standard Contractual Clauses with every EU customer
Privacy notice on your website if you serve Europeans
EU representative appointed where required

Food and labour

Residue and contaminant analysis per batch or per season
Label checked against EU rules and the country's language
Employment contracts, payslips and working time records in order. Payslip generator
List of subcontractors and recruitment agencies

What if...

...my customer asks for something under a law that does not apply to me? That is normal: the customer must prove compliance itself. You can still negotiate what is reasonable and who pays.
...I buy timber or cocoa from small farmers without GPS data? Then you must map the plots yourself (or have them mapped) with a smartphone or GPS device. Without geolocation the batch cannot legally enter the EU from the application date.
...my customer requires an ISO 27001 certificate? Ask whether a completed questionnaire with evidence is enough for now. Certification takes months of preparation and an external audit.
...I supply to French Guiana? That is EU territory: all rules on this page apply there too. See Trade agreements and market access.
...I do not know what import duty my customer pays? Under the EPA usually 0%, provided you send proof of origin. See Trade agreements and market access.

Sources

Checked on 26 October 2026. General information, not legal advice. EU rules and dates change often; check the current status with your customer or an adviser.

Frequently asked questions

Do EU rules such as the EUDR apply in Suriname?

No, they are not Surinamese law. But your European customer must comply and therefore asks you for data and guarantees. If you cannot provide them, the customer can no longer buy your product or sell it in the EU.

When does the EU Deforestation Regulation (EUDR) apply?

From 30 December 2026 for large and medium-sized companies and from 30 June 2027 for micro and small companies (except timber). In May 2026 the European Commission confirmed there will be no further delay.

What does an EU buyer of timber or cocoa ask for under the EUDR?

The geolocation of every plot the product comes from (a polygon for plots larger than 4 hectares), evidence that there was no deforestation after 31 December 2020, and evidence that production was legal under Surinamese law.

Must my company comply with NIS2 if I supply IT services to the Netherlands?

The Dutch Cybersecurity Act (in force since 15 August 2026) does not apply to you, but your customer must manage risks in its supply chain. Expect a security questionnaire, contract terms and a request to show your measures.

Does the GDPR apply to a Surinamese company?

Yes, if you offer goods or services to people in the EU or monitor their behaviour, or if you process personal data for an EU customer. Suriname has no adequacy decision, so your customer will usually require Standard Contractual Clauses.

When does the EU ban on products made with forced labour apply?

Regulation (EU) 2024/3015 applies from 14 December 2027 to all products on the EU market, regardless of company size. The European Commission published its guidelines on 26 June 2026.

As a small supplier, must I produce a CSRD sustainability report?

No. After the Omnibus amendment of February 2026, only EU companies with more than 1,000 employees and more than EUR 450 million turnover report. They may only ask limited information from suppliers with fewer than 1,000 employees.