The objective of this consultancy is to provide expert advice and guidance to CARE Kenya to ensure compliance with the law on the protection of personal data and privacy. The consultancy should include a comprehensive diagnosis of CARE Kenya’s data protection practices, perform a gap analysis with the law requirements, and the development and implementation of a roadmap for achieving compliance.
The scope of work for the consultancy should include, but not be limited to:
- Conduct a diagnosis of CARE Kenya’s data mapping, process, procedures, systems, consent management tools implying project participants employees, suppliers’ personal data in connection with the law on the protection of personal data and privacy, a process for transfer of data within Kenya and across borders – security assessment for transfer. E.g. Encryption.
- A process for PIA and DP[IA – to identify privacy risks in each systems and vendors.
- Contract management – Data Privacy agreement template and process.
- DSR – Data subject request fulfillment process.
- Privacy by design process.
- A process for documenting all the processing activities RoPA.
- Identify areas of non-compliance with the Data Protection Act CAP 2019 and develop roadmap for achieving compliance with the ACT.
- Revise and update current data protection policies and practices (consent forms, data privacy, cookie policy, Employee privacy policy, data retention and deletion policy, Data Protection Agreement, Transfer Impact Assessment Process, Assess, requirements for DPO ) to ensure alignment with the law.
- Develop and roll out a program of CARE Kenya and partners’ staff awareness and training to achieve compliance and foster a culture of data privacy within the organization.
- Incident and breach management processes DPIA and PIA processes for both vendors and business units/systems.
For more details click on the Terms of Reference link:
Email your application to [email protected] by end of day 25th April 2025. Use “Data Protection and Privacy” as the subject title of your email. Incomplete applications will not be considered, and only shortlisted candidates will be contacted.
