Provision of Data Protection Advisory Services — Digital Malawi Acceleration Project

REQUEST FOR EXPRESSIONS OF INTEREST

(CONSULTING SERVICES – FIRMS SELECTION)

COUNTRY: MALAWI

NAME OF PROJECT: DIGITAL MALAWI ACCELERATION PROJECT

GRANT NO: IDA-E338-MW

ASSIGNMENT TITLE: PROVISION OF ADVISORY AND TECHNICAL SUPPORT CONSULTANCY SERVICES IN THE OPERATIONALIZATION OF THE DATA PROTECTION ACT OF 2024.

REFERENCE NO.: MW-PPPC-502049-CS-QCBS

The Government of Malawi (GoM) has received a grant from the International Development Association (IDA) under the Digital Malawi Acceleration Project (DMAP) to increase access to, and inclusive use of, the internet and improve the Government's capacity to deliver digitally enabled services. The line Ministry and owner of the Project is the Ministry of Information and Digitalization (MoID) whereas lead implementation agency for the project is the Public Private Partnership Commission (PPPC). Other stakeholders include Ministry of Education, MAREN, the National Registration Bureau, the Malawi Communications Regulatory Authority (MACRA), Ministry of Lands and others

The consulting services (“the Services”) will comprise several interrelated components designed to provide comprehensive support in the operationalization of the Data Protection Authority (DPA) under the Data Protection Act, 2024. The Consultant is expected to carry out the following tasks:

• Establish credible, well-governed Data Protection Authority unit that commands public confidence and is capable of independently and efficiently discharging its statutory mandate.

• Create a clear and enforceable regulatory framework that protects personal data, promotes responsible data management practices across sectors, and supports Malawi’s digital transformation agenda Monitoring Visit Preparations

• Ensure the availability of practical tools, guidelines, and legal instruments that enable the Data Protection Authority to monitor compliance, address data breaches, and enforce the law effectively

• Develop institutional capacity within MACRA to implement data protection policies and standards, including a workforce equipped with the necessary skills and competencies to promote and enforce data privacy across both the public and private sectors

• deliver a clear, phased plan that guides the structured and sustainable operationalization of the Data Protection Authority unit, ensuring that the process is well-coordinated, resource-efficient, and aligned with Malawi’s national priorities and international commitments

The assignment is for a period of five (5) months with an estimated level of input of 100-man days for Key Experts The detailed Terms of Reference (TORs) can be obtained at the following address https://www.pppc.mw/procurement; or can also be obtained upon request at the address given below.

The Public Private Partnership Commission (PPPC) now invites eligible qualifying Consulting firms (“Consultants”) to indicate their interest in providing the Services. Interested Consulting Firms should provide information demonstrating that they have the required relevant experience to perform the Services. The shortlisting criteria are:

• Core business of the firm(s) and years in business

• Relevant similar experience, which should specifically include:

• Having at least five (5) years of experience in data protection, ICT regulatory frameworks, or institutional capacity-building.

• Having successfully completed at least three (3) assignments of a similar nature, complexity, and operating environment in the last seven (7) years

• Having successfully implemented at least two (2) similar assignments of comparable scope in Africa or other emerging jurisdictions.

• The firm should demonstrate having a solid team of professionals in relevant areas as indicated in the TORs. (Provide only the structure of the organization, general qualifications and experience, and number of key staff. Do not provide detailed CV of the staff. Experts will not be evaluated at the shortlisting stage.

The attention of interested Consultants is drawn to Section III, paragraphs, 3.14, 3.16, and 3.17 of the World Bank’s “Procurement Regulations for IPF Borrowers” dated September 2025 (“Procurement Regulations”), setting forth the World Bank’s policy on conflict of interest.

Consultants may associate with other firms to enhance their qualifications but should indicate clearly whether the association is in the form of a joint venture and/or a sub-consultancy. In the case of a joint venture, all the partners in the joint venture shall be jointly and severally be liable for the entire contract, if selected.

A Consultant(s) will be selected in accordance with the Quality and Cost Based Selection (QCBS) method set out in the Procurement Regulations.

Further information can be obtained at the address below during office hours from 08:00 to 16:30 hours, local time. Detailed terms of reference (ToRs) are available on the PPPC Website, www.pppc.mw/procurement. The ToRs can also be sent to interested consultants by e-mail upon request from the e-mail address indicated below.

Expressions of interest must be delivered in a written form to the address below (in person, or by mail, or by fax, or by e-mail) by 28th November 2025 at 4:00pm Local Time.

The Chairperson,

Internal Procurement and Disposal Committee,

Public Private Partnership Commission

2nd Floor, Livingstone Towers

Glyn Jones Road

P.O. Box 937

Blantyre

MALAWI

Tel: +265 1 823 655; Fax : +265 1 821 248 ; E-mail : [email protected]