MESPT-ICT-03-2023 – Consultancy Services on Data Protection Act (DPA) 2019 (Eligible to Consulting firms Only) – Kenya

PROVISION OF CONSULTANCY SERVICES ON DATA PROTECTION ACT (DPA) 2019

1. INTRODUCTION

Micro-Enterprises Support Programme Trust (MESPT) is a Kenyan development organization established in 2002. MESPT’s overall objective is to promote economic growth, employment creation and poverty alleviation through enterprise development. This is achieved predominantly through support to the development of agricultural value chains whilst embracing and promoting the green growth and climate change agenda. Through its vision of building a more Prosperous Society, MESPT facilitates increased commercialization, decent employment and green transformation through targeted interventions in the selected value chains. The Trust is a multi-donor entity jointly founded by the Government of Kenya and the European Union who later relinquished their position to the Royal Danish Embassy in Kenya, Ministry of Foreign Affairs of Denmark (DANIDA). To learn more about MESPT, please visit www.mespt.org.

1. BACKGROUND

MESPT collects personal information from various stakeholders while carrying out its mandate. MESPT is aware about the Data Protection Act and is cognizant of the importance of being compliant to this ACT. We are seeking consultants to help us ensure that we are compliant with the Data Protection Act.

1. OBJECTIVE OF THE ASSIGNMENT

The objective is to facilitate the development of MESPT data Protection and Privacy Policy, carry out Data Protection Act Gap assessment and provide recommendations on the way forward to ensure MESPT is compliant with the Data Protection Act 2019.

Specific Objectives

1. Creating Awareness on the Data Protection Act: this is to all MESPT staff and board members.
2. Data Protection Impact Assessment: Identify personal data that is collected, the source of the data, reason for collecting, lawful basis for processing, is consent obtained, is data subject informed of collection and their rights? Is special category data collected? Are the right tools used to collect personal data?
3. Subject Access Requests: help with defining and documenting business processes that will ensure that MESPT is able to respond to subject access requests within the required timelines.
4. Data Protection Act Gap assessment
5. Development of the Data protection and privacy policy
6. Recommendation: provide a framework for closure of identified gaps to ensure MESPT is DPA compliant
7. METHODOLOGY

It is recommended that for maximum value generation for this assignment, the consultant will adopt a participatory approach, this will be through creating awareness of the DPA to all MESPT staff and board, collating and reviewing documents, carrying out interviews with every unit/programme to identify the types of personal data collected, how consent is obtained etc. during the Data Protection Impact Assessment.

1. SCOPE OF WORK

The consultant will be expected to carry out and deliver on the following tasks:

1. Conduct a systematic review of the relevant literature including-Draft Data Protection Policy, MESPT Policiesto align them with the Data Protection Act, review the existing consent form and make recommendations.
2. Hold consultations (face-to-face and/or virtual) with staff and relevant stakeholders on methodologies and approaches for engagement
3. Based on the above, formulate and develop MESPT DPA Policy that ensures compliance of MESPT in all aspects of the DPA
4. Organize consultations for reference group (Management, Staff and Board) review to critique the policy and validate key findings, approaches, and the proposed policy direction
5. Make recommendations for appropriate orientation and capacity building on the policy
6. Validation of the draft policy – Management and staff
7. Presentation and approval to the Board
8. EXPECTED DELIVERABLES
9. Inception report for the assignment outlining approach/methodology.
10. Report on Data Protection Gap Assessment
11. Framework for closure of identified gaps
12. Data Protection Policy, Consent form(s), Data Processing Agreement(s), Data mapping document, procedure for handling data subjects’ requests, privacy documents (board of trustees, job applicants, privacy notice for employees, workers and contractors, social media policy, website privacy policy), development of data protection clauses/agreement to be included in contracts and loan agreements, any other accompanying tools
13. Assignment Timelines

The consultant should finish all the above within eight weeks.

1. Qualification and Competencies

2. The firms experience with provision of legal consultancy services (Minimum of 10 years).

3. The proposed consultant (s) must demonstrate experience in undertaking similar assignments with regards to Data Protection Act Consultancy by providing at least three references of such assignments in the last three years.

4. The Lead consultant should have;

   • law degree from an accredited law school
   • Hold at least one data protection and/or privacy certification
   • 6 years’ experience within a compliance, legal, audit and/or risk function with experience in privacy compliance
   • Experience with data privacy laws within the region and/or EU Data privacy laws

5. The list of proposed staff by specialty. Qualifications of team members evidenced by professional certifications and CVs.

   • law degree from an accredited law school
   • Hold at least one data protection and/or privacy certification
   • 3 years’ experience within a compliance, legal, audit and/or risk function with experience in privacy compliance
   • Experience with data privacy laws within the region and/or EU Data privacy laws

6. Proposed methodology work plan including timeframes. This entails the detailed project schedule that covers the project plan, schedule and resource allocation.

7. Any comments or suggestions on the terms of reference, a list of services to be provided by the client.

How to apply

Download tender document by clicking on the following link

https://mespt.org/tender-opportunities/