CONSULTANCY FOR DATA PROTECTION COMPLIANCE GAP ANALYSIS, STAFF TRAINING AND POLICY UPDATE

Overview

 

INTRODUCTION

Jhpiego Corporation is an international, non-profit, global health affiliate of Johns Hopkins University, that works to improve the health of women and families throughout the world. For over 50 years, and in more than 150 countries, Jhpiego has worked to prevent the needless deaths of women and their families. Jhpiego has empowered front-line health workers by designing and implementing effective, low-cost, hands-on solutions that strengthen the delivery of healthcare services

Background

Following the successful registration of Jhpiego Zambia’s country office with the Data Protection Commissioner and subsequent consultations with Global IT on existing data protection policies, the organization is required to operationalize compliance measures in line with the Data Protection Act. The TORs outlines the steps, responsibilities, and governance framework to ensure adherence to statutory obligations and organizational standards. To strengthen compliance, the organization seeks to engage a qualified consultant/firm to conduct a comprehensive gap analysis, train staff on data handling practices, and update organizational policies to align with statutory requirements of the Data Protection Act.

Objectives of the Assignment

Assess the organization’s current data protection practices against the requirements of the Data Protection Act of Zambia.

Identify gaps, risks, and areas for improvement in data collection, storage, processing, and sharing.

Build staff capacity through tailored training on lawful data handling, privacy, and security.

Update and harmonize organizational data protection policies and procedures to ensure compliance

Through this Request for Proposal, Jhpiego intends to engage the Consultant/Firm for the period of 8 weeks from the date of Contract signing.

The engagement will be dependent on the vendor’s ability to provide services that meet the requirements outlined in the Scope of Work and the most competitive price. Although Jhpiego is entering into this RFP process with the intention of evaluating Consultants and possibly procuring services from a consultant/firm, this document is not in anyway a commitment for Jhpiego to make any purchase or make any other legal commitment to enter a business relationship with any bidder.

Jhpiego Schedule

The following is the planned schedule for this RFP process. All dates are listed in the local time for central Africa Time, Lusaka, Zambia (GMT+2). We will update you if circumstances dictate a change to this schedule.

Publication of the RFP March 19 -31, 2026

Bidder Questions Due: March 25, 2026/ 13:00 Hours.

Proposals Due: March 31, 2026 / 13:00 Hours.

Note: We highly encourage you to comply with the above deadlines or it will be interpreted as your intention to not participate in this RFP.

Contact Details

Please direct all questions to the following primary contact:

ZMProcurement@jhpiego.org

Responsibilities

SCOPE OF WORK

The consultant/firm will be expected to:

Conduct Gap Analysis

• Review existing policies, systems, and practices.
• Benchmark against the Data Protection Act and international best practices.
• Provide a detailed report highlighting compliance gaps and recommendations.

Policy Update

• Revise and update the organization’s data protection policy.
• Draft clear procedures for data handling, retention, and disposal.
• Ensure alignment with Zambia’s Data Protection Act and organizational values.

Staff Training

• Design and deliver training modules for staff at different levels (management, operations, IT, etc.).
• Cover topics such as lawful data processing, consent management, data subject rights, breach reporting, and secure handling of sensitive data and provide certifications
• Provide training materials and post-training evaluation.

Deliverables

• Inception report outlining methodology and work plan.
• Gap analysis report with prioritized recommendations.
• Training sessions delivered (with attendance records and evaluation results).
• Updated Data Protection Policy and related procedures.
• Final consultancy report summarizing activities, outcomes, and recommendations.

 

Duration of Assignment

The consultancy is expected to be completed within 8 weeks from the date of contract signing.

Required Qualifications

• Possess a valid practicing license with the Zambia Data Protection Authority
• Cyber Security Specialist (Social Scientist, Information Systems and Law as an added advantage)
• Demonstrated expertise and understanding of the Data Protection Compliance Act of Zambia of 2021. Preferably knowledge of the NGO.
• Experience conducting gap analyses and delivering staff training with minimum of 5 years and above.
• Strong knowledge and implications of the Data Protection Act of Zambia (2021) and international data protection standards
• Excellent communication, facilitation, and report-writing skills.

Reporting and Supervision

The consultant will report to the Country Director and work closely with designated staff to ensure smooth execution of the assignment.

Payment Terms

Payment will be made in installments based on satisfactory delivery of agreed outputs:

• Upon submission of inception report.
• Upon completion of gap analysis and training.
• Upon submission of final updated policy and consultancy report.

Application Process

Interested consultants should submit:

• A technical proposal outlining methodology and work plan.
• A financial proposal with detailed budget.
• CV and evidence of relevant experience.
• At least two references from similar assignments.

 

 

PRELIMINARY MINIMUM REQUIREMENTS AND EVALUATION CRITERIA

The vendors shall meet the following minimum requirements:

Certificate of incorporation and registration with PACRA.

Valid tax registration and current tax clearance certificate -2026

Current Certificate of registration with National Pensions Scheme Authority (NAPSA)

Organization profile (Applicable for Companies)

Workers Compensation License for 2026

Bank detail on a bank letter head

Physical and official email address

Trading Licenses for 2026

At least three references from Institutions where your organization is having and or have executed such contracts

 

EVALUATION CRITERIA

• CV of Key Personnel (5%)
• Evidence of relevant experience (15%)
• Technical proposal outlining methodology and work plan (25%)
• A financial proposal with detailed budget (15%)
• At least two references from similar assignments (40%)

 

References will be considered as an evaluation factor if you are selected as a finalist. The references will not be contacted unless Jhpiego informs you in advance.

Directions for Response

All responses to this RFP must include the components and follow the guidelines below. Any proposal that does not follow these guidelines shall be disqualified.

Complete and submit the following component in your proposal:

All prices shall be quoted in Zambian Kwacha.

Company Profile with qualifications for the key Technical Staff (3 copies)

Proposals shall be submitted on your company’s original letterhead (Not the one for Jhpiego) and signed.

Complete description/specifications of the services.

Unit price shall be indicated separately.

For local Consultants a 15% WHT applies to local Consultant fees .

The Proposal validity period shall be 90 days from the date of submission.

Direct all questions to the primary contact (see “Contact Details” section) via e-mail by the time indicated “Central Africa Time, Lusaka, Zambia (GMT+2)” on the day indicated in the schedule.

Questions about the designated primary contact are entirely welcome. However, any violation of these directions will be considered an attempt to gain an unfair advantage over the other competitors and will result in disqualification of the violating bidder. Any disqualified bidders will be removed from the process and any further submissions by that bidder will not be accepted.

Jhpiego reserves the right to reject proposals and bears no responsibility for any costs of preparing any proposal.

Questions From Bidders

In the interest of fairness and completeness of answers, all questions from all bidders will be aggregated, answered and sent to all bidders on the date and time indicated in the schedule.

Please submit your questions to the primary contact identified above via email by the day they are due (see “Schedule” section).

Proposal Validity

Vendor shall submit a proposal that is valid for 60 days after the proposal due date per the “Schedule” section above.

Award of Contract

The firm that, in the opinion of Jhpiego, has submitted the proposal providing the best value for Jhpiego based on the evaluation criteria will be selected as best evaluated Vendor for the agreed period of task execution.

Contract Terms

 

Any resulting agreement will be conditional upon the vendor’s acceptance of Jhpiego Corporation’s Terms and Conditions Annexed to this RFP.  Jhpiego’ s standard payment terms are 30 Days.

 

SUBMISSION AND CLOSING DATE OF THE PROPOSALS

The REQUEST FOR PROPOSALS shall be submitted in four packs (One. Original and Three Copies) in sealed envelopes clearly marked “CONSULTANCY FOR DATA PROTECTION COMPLIANCE GAP ANALYSIS, STAFF TRAINING AND POLICY UPDATE.” to Plot 8 Ngumbo Road Long acres, Lusaka, Jhpiego Zambia Country Office on or before 13:00 hours, March 31, 2026 in the Tender box placed at the RECEPTION and signed off in the tender register book. Quotations submitted after the set deadline shall not be received or accepted and returned unopened to the marked bidder.

Jhpiego Zambia Country Office reserves the right to accept or reject any quotation and annual the bidding process and reject all bids at any time prior to contract award, without thereby incurring any liability to bidders.