Personal Data Protection Compliance & Audit Advisor for ECA

REQUEST FOR EXPRESSION OF INTEREST (Consulting Services – Individual Selection) Senior Personal Data Protection Compliance & Audit Advisor | Country | Ethiopia | Project | Ethiopia Digital ID for Inclusion and Services Project | Project ID | P179040 | Assignment Title | Senior Personal Data Protection Compliance & Audit Advisor | Reference No. | ET-NIDP-573615-CS-INDV | Required No. | 1 (one) | Organization | Ethiopian Communications Authority (ECA) | Duty Station | Ethiopian Communications Authority (ECA), Addis Ababa, Ethiopia | Employment Type | Contract | Duration | 12 months, with possibility of extension subject to satisfactory performance and availability of budget The Federal Democratic Republic of Ethiopia, Ministry of Finance (MoF), has received financing from the World Bank toward the cost of the Ethiopia Digital ID for Inclusion and Services Project. The National ID Program (NIDP), the ultimate project implementer, intends to apply part of the proceeds for selecting an individual consultant. The National ID Program is seeking a Senior Personal Data Protection Compliance & Audit Advisor to support the Ethiopian Communications Authority (ECA) in strengthening ECA’s personal data protection compliance, audit, inspection, risk assessment, and regulatory supervision functions under Personal Data Protection Proclamation No. 1321/2024 and applicable subsidiary legislation, directives, standards, and guidelines. 1. Background The Government of Ethiopia has established a comprehensive legal framework for the protection of personal data through Personal Data Protection Proclamation No. 1321/2024. The Proclamation designates the Ethiopian Communications Authority (ECA) as the national authority responsible for regulating and enforcing personal data protection. ECA’s mandate includes, among others, registration and supervision of data controllers and processors, compliance monitoring, investigation of violations and complaints, development of regulatory instruments, and enforcement of personal data protection requirements. The Proclamation establishes obligations concerning lawful and fair processing, purpose limitation, storage limitation, security and confidentiality, data-subject rights, registration of controllers and processors, Data Protection Officers, technical and organizational measures, breach notification, Data Protection Impact Assessments (DPIAs), and privacy by design. The implementation of these requirements requires ECA to develop a risk-based, systematic and evidence-based compliance and audit capability capable of assessing whether public and private sector organizations are effectively complying with the Proclamation and applicable subsidiary legislation, directives, standards and guidelines. This is further reinforced by Digital Ethiopia 2030, which assigns ECA an expanded role in implementing personal data protection and exercising proactive oversight of digital platforms and data markets. 2. Objective of the Assignment The overall purpose of the assignment is to provide senior-level professional expertise to strengthen ECA’s personal data protection compliance, audit, inspection and supervisory functions. The Advisor will support ECA in developing and implementing a risk-based compliance and audit framework for data controllers and processors; conducting compliance assessments and audits; identifying systemic and sector-specific privacy risks; assessing technical and organizational measures; supporting DPIA and high-risk processing assessments; developing audit tools and methodologies; monitoring corrective actions; and providing evidence-based recommendations for regulatory intervention and enforcement. The Advisor shall also support ECA in translating the personal data protection objectives of Digital Ethiopia 2030 into practical supervisory mechanisms for digital platforms, data-driven businesses, emerging technologies and data markets. 3. Scope of Services / Key Responsibilities The Advisor will: • Establish risk-based frameworks, indicators, maturity models, and annual plans for supervisory inspections, audits, desk reviews, and regulatory follow-ups. • Plan and lead audits to assess compliance with Proclamation No. 1321/2024 and other applicable laws and directives, evaluating entities’ governance structures, DPO arrangements, policy enforcement, registration accuracy, and data-subject rights implementation. • Evaluate the adequacy of technical controls, including access management, encryption, logging, backup, physical security, data localization, cloud arrangements, and cross-border transfer safeguards. • Review Data Protection Impact Assessments (DPIAs) and assess risks linked to high-risk processing, digital platforms, data monetization, and emerging technologies, including AI, biometrics, digital ID, cloud, IoT and fintech. • Assess breach preparedness, investigate root causes and control failures in reported incidents, review notification compliance, and oversee remedial action plans. • Provide technical evidence, risk ratings, and recommendations to support ECA’s regulatory inquiries, enforcement actions, corrective orders, and administrative sanctions. • Formulate standardized supervisory toolkits, including audit manuals, inspection checklists, sector guidelines, DPIA/breach assessment templates, and compliance dashboards. • Deliver technical training, develop audit materials, mentor ECA inspection teams, and facilitate awareness workshops with controllers, processors, and peer data protection authorities. • Execute any additional assignments directed by ECA leadership to support ECA’s mandate. 4. Minimum Qualifications and Professional Experience The candidate should have: • A minimum of a Master’s degree in Information Technology; Computer Science; Cybersecurity; Information Security; Information Systems; Data Science/Data Engineering; Computer Engineering; Telecommunications Engineering; Digital Transformation; Privacy/Data Protection; Risk Management; or another closely related discipline. • At least ten (10) years of progressively responsible professional experience in personal data protection, privacy compliance, information security, technology risk, IT audit, cybersecurity, data governance, regulatory compliance, or related fields. • Of which at least five (5) years shall involve substantial experience in personal data protection/privacy compliance, IT audit, information-security auditing, regulatory supervision, or data-governance assessment. • Demonstrated experience conducting compliance audits, IT audits, privacy assessments, security assessments or regulatory inspections. • Demonstrated experience developing compliance frameworks, audit methodologies, risk assessment tools and supervisory mechanisms. • Experience assessing cloud environments, data centers, digital platforms, data-sharing arrangements and third-party processors. • Experience in data breach assessment and incident-response compliance. • Experience working in a multi-stakeholder regulatory environment. • Good communication skills in both English and Amharic. 5. Duration and Location The consultant will be engaged on a full-time basis for an initial period of twelve (12) months, with the possibility of extension subject to satisfactory performance and availability of budget. The position will be based in Addis Ababa, Ethiopian Communications Authority (ECA). The Advisor shall report to the Deputy Director General responsible for Personal Data Protection at ECA, or another designated ECA supervisor, and shall work in close coordination with the Personal Data Protection Directorate and other relevant ECA departments. 6. Selection Method The selection method is based on paragraphs 7.36 and 7.37 of the World Bank’s Procurement Regulations. The attention of interested individuals is drawn to Section III, paragraphs 3.14, 3.16, and 3.17 of the World Bank’s “Procurement Regulations for IPF Borrowers,” July 2016, as revised November 2017, August 2018, and February 2025, setting forth the World Bank’s policy on conflict of interest. An individual will be selected in accordance with the Selection of Individual Consultant (Section V) method set out in the Procurement Regulations. 7. Submission of Expression of Interest The National ID Program, Digital ID for Inclusion and Services Project, now invites eligible individual consultants to indicate their interest in providing the Services. Interested consultants should provide information demonstrating that they have the required qualifications and relevant experience to perform the Services. The Expression of Interest should include CV, formal application/cover letter; and Documentary evidence supporting the stated qualifications and experience, including descriptions of relevant assignments and experience in similar conditions. CVs, formal application letters and all supporting documents must be delivered in written form to the address below in person, or by mail, preferably by e-mail, on or before November 16, 2026. Further information may be obtained by e-mail during office hours from 8:30 AM to 5:30 PM Addis Ababa time. Submission Address: Federal Democratic Republic of Ethiopia

National ID Program (NIDP)

Digital ID for Inclusion and Services Project

Attn: Project Management Unit (PMU)

Address: Welosefer Bole, Ethio-China St, INSA Building, 14th Floor, Addis Ababa, Ethiopia

Tele: +251-912-200295 or +251-911-446582

E-mail: nejmedin@id.et and zelalem@id.gov.et; copy: mesfin@id.et

Website: https://id.gov.et/ Addis Ababa, Ethiopia