Consultancy services to scale up data protection and privacy audit and inspec…

REQUEST FOR EXPRESSION OF INTEREST

(CONSULTING SERVICES – FIRMS SELECTION)

UGANDA

UGANDA DIGITAL ACCELERATION PROJECT – GOVERNMENT NETWORK (UDAP-GOVNET)

PROJECT ID-P171305

LOAN NUMBER: IDA-68980

REFERENCE NUMBER: NITA-UDAP/CONS/25-26/00054

ASSIGNMENT TITLE: Consultancy services for Upscaling of the Data Protection and Privacy Audit and inspection project to cover an additional Ten (10) Government Agencies

The Government of Uganda, represented by the National Information Technology Authority - Uganda (NITA-U), has received financing from the World Bank towards the cost of the Uganda Digital Acceleration Project - Government Network (UDAP-GOVNET) and intends to apply part of the proceeds for Consultancy services for Upscaling of the Data Protection and Privacy Audit and inspection project to cover an additional Ten (10) Government Agencies

The consulting services (“the Services”) include Consultancy services for Upscaling of the Data Protection and Privacy Audit and inspection project to cover an additional Ten (10) Government Agencies. The overall objective of this assignment is to conduct ten (10) independent and comprehensive Data Protection and Privacy Audits aimed at determining the extent to which each audited entity complies with applicable data protection and privacy requirements and identifying opportunities for continuous improvement. The audits shall provide assurance to management, the Board, regulators, and other stakeholders regarding each audited entity’s ability to protect personal data and manage privacy risks.

The Implementation period of the assignment is 6 Months from the date of signing the contract.

The detailed Terms of Reference (TOR) for the assignment can be found at the following website: https://www.nita.go.ug/opportunities/bids-and-tenders

The National Information Technology Authority - Uganda now invites eligible consulting firms (“Consultants”) to indicate their interest in providing the services. Interested Consultants should provide information demonstrating that they have the required qualifications and relevant experience to perform the Services.

The Shortlisting Criteria for the firm’s capacity and experience are:

• At least five (5) years of demonstrable experience and expertise in development of manuals, strategies, policies, reference guides and execution of audits (either ICT, data protection and privacy or compliance audits). It will be an added advantage where such experience is in Government or in the not-for-profit sector.
• The consultancy firm shall possess a minimum of 3 (Three) assignments completed in Information Systems Audit, Information Security Assessment or Data Protection and Privacy.
• Submit the firm’s organogram to demonstrate the firm’s technical and managerial capability;
• The consulting firm must demonstrate the ability to field a team of experts with the required qualifications and experience for the assignment. These shall include at least: Information Technology/Information Systems Audit Expert, Legal advisor in data protection and privacy, Information Security Expert.

The attention of interested consultants is drawn to Section III, paragraphs 3.15, 3.16, of the World Bank’s ‘Procurement in Investment Project Financing Goods, Works, Non-Consulting and Consulting Services, Seventh Edition September 2025 (Procurement in investment Project Financing; Goods, Works, Non-Consulting and Consulting Services), setting forth the World Bank’s policy on conflict of interest.

Consultants may associate with other firms to enhance their qualifications, but should indicate clearly whether the association is in the form of a joint venture and/or a sub-consultancy. In the case of a joint venture, all the partners in the joint venture shall be jointly and severally liable for the entire contract, if selected.

A consultant will be selected in accordance with the Consultant Qualification Selection method set out in the World Bank Procurement Regulations “Procurement in Investment Project Financing Goods, Works, Non-Consulting and Consulting Services, Seventh Edition September 2025”.

Further information can be obtained at the address below during office hours at the address below 08:00 to 17:00 hours from Monday to Friday at the address given below.

Expressions of Interest (One original plus two copies) must be delivered in a written form to the address below (in person or by e-mail) on or before 16th July 2026 at 11:00am Consultants not located in the Country may submit their REOIs through the provided email address.

The packages must be clearly marked as; “Expression of Interest for Consultancy services for Upscaling of the Data Protection and Privacy Audit and inspection project to cover an additional Ten (10) Government Agencies.”

The Procurement Officer,

National Information Technology Authority-Uganda Palm Courts, Plot 7A Rotary Avenue,1st Floor Kampala-Uganda,

Email: [email protected]

Any form of canvassing or lobbying for the tender shall lead to automatic disqualification.

EXECUTIVE DIRECTOR.